Vulnerability · Published Oct 15, 2026 · Assigned by qnap

CVE-2026-53882Path Traversal in Virtualization Station VM Import

High 8.7

In plain English

A high-severity security flaw in Virtualization Station from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 69.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	Virtualization Station	4.1.x – before 4.1.1.130

Weakness: CWE-59 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.qnap.com/en/app_releasenotes/list.php?app_choose=QKVM release-notes