title: QTS, QuTS hero, QuTScloud
description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.0.2444 build 20230629 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTScloud c5.1.0.2498 and later
problem types: CWE-22
affected:
{
defaultStatus: unaffected
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 5.1.0.2444 build 20230629, status: affected, version: 5.1.x, versionType: custom
}
{
defaultStatus: unaffected
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h5.1.0.2424 build 20230609, status: affected, version: h5.1.x, versionType: custom
}
{
defaultStatus: unaffected
product: QuTScloud
vendor: QNAP Systems Inc.
versions:
lessThan: c5.1.0.2498, status: affected, version: c5.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: We have already fixed the vulnerability in the following versions:
QTS 5.1.0.2444 build 20230629 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTScloud c5.1.0.2498 and later
