CVE-2025-53594: Qfinder Pro, Qsync, QVPN
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions: Qfinder Pro Mac 7.13.0 and later Qsync for Mac 5.1.5 and later QVPN Device Client for Mac 2.2.8 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53594?
The severity of CVE-2025-53594 is considered high due to the potential for local attackers to access sensitive files.
How do I fix CVE-2025-53594?
To fix CVE-2025-53594, update your QNAP product to the latest versions provided by QNAP.
Which products are affected by CVE-2025-53594?
CVE-2025-53594 affects QNAP Qfinder Pro versions prior to 7.13.0, Qsync versions prior to 5.1.5, and QVPN Device Client versions prior to 2.2.8.
Can CVE-2025-53594 be exploited remotely?
CVE-2025-53594 cannot be exploited remotely; it requires local access to a compromised user account.
What can an attacker do by exploiting CVE-2025-53594?
An attacker exploiting CVE-2025-53594 can read unexpected files or system data, potentially leading to further security breaches.