title: Improper Limitation of a Pathname to a Restricted Directory in QTS
description: A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.
problem types: CWE-20 Improper Input Validation
affected:
{
platforms: build 20190328
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.3.6.0895, status: affected, version: unspecified, versionType: custom
}
{
platforms: build 20190322
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.3.4.0899, status: affected, version: unspecified, versionType: custom
}
{
product: QTS
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: 4.5.x
status: unaffected, version: 4.4.x
}
solutions: QNAP have already fixed this vulnerability in the following versions:
QTS 4.3.6.0895 build 20190328 (and later)
QTS 4.3.4.0899 build 20190322 (and later)
This issue does not affect QTS 4.4.x or QTS 4.5.x.