Vulnerability · Published Jan 2, 2026 · Assigned by qnap
CVE-2025-53594Qfinder Pro, Qsync, QVPN
Medium 4.4
In plain English
A medium-severity path traversal in Qfinder Pro Mac from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Qfinder Pro Mac 7.13.0 and later Qsync for Mac 5.1.5 and later QVPN Device Client for Mac 2.2.8 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | Qfinder Pro Mac | 7.13.x – before 7.13.0 |
| QNAP Systems Inc. | Qsync for Mac | 5.1.x – before 5.1.5 |
| QNAP Systems Inc. | QVPN Device Client for Mac | 2.2.x – before 2.2.8 |
Weakness: CWE-22, CWE-59, CWE-367 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U