CVE-2025-62842 HIGH

CVE-2025-62842: HBS 3 Hybrid Backup Sync

Vendor Qnap Systems Inc.
Product HBS 3 Hybrid Backup Sync
Weakness CWE-73
Published January 2, 2026
Last update January 5, 2026
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.2.0.938 and later

Key dates

02Disclosure timeline

January 2, 2026 CVE published
January 5, 2026 Record updated