CVE-2025-59384 HIGH

CVE-2025-59384: Qfiling

Vendor Qnap Systems Inc.

Product Qfiling

Weakness CWE-22 · Path traversal

Published January 2, 2026

Last update January 5, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qfiling 3.13.1 and later

Key dates

02Disclosure timeline

January 2, 2026 CVE published

January 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-59384 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2022-1166 JobMonster < 4.6.6.1 - Directory Listing in Upload Folder CVE-2026-57079 Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal CVE-2024-5019 WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability CVE-2026-11416 MoviePilot Path Traversal via Cloud Storage Download Handlers