VulnerabilityAwaiting Analysis

CVE-2026-41541

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.

MEDIUM 5.3EPSS 0.38%

Does this matter?

Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.

Description

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.38% probability · 32th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-61
Source: security@qnapsecurity.com.tw

EPSS trend

EPSS moved from 0.5% on 15 October 2026 to 0.4% on 26 October 2026.

References

https://www.qnap.com/en/app-release-notes?keyword=Qsync%20&app=QsyncServer&product-line=nas

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.