All vulnerabilities
CVE-2026-47790

Privilege Escalation via QuFTP Log-based XSS

QNAP Systems Inc. QuFTP Service
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.6Also 1.5.5, 1.6.5CVE List
Published15 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.

We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later

Text from CVE List

Affected versions 3

  • QuFTP Serviceaffected: 1.4.x before 1.4.6CVE List
  • QuFTP Serviceaffected: 1.5.x before 1.5.5CVE List
  • QuFTP Serviceaffected: 1.6.x before 1.6.5CVE List

References 1