CVE-2025-66277: QTS, QuTS hero

Q: What is the severity of CVE-2025-66277?

CVE-2025-66277 is classified as a high severity vulnerability that can allow remote attackers to traverse the file system.

Q: How do I fix CVE-2025-66277?

To fix CVE-2025-66277, update to the latest versions of QTS or QuTS hero that address this vulnerability, specifically QTS 5.2.8 or later.

Q: Which QNAP operating system versions are affected by CVE-2025-66277?

CVE-2025-66277 affects multiple versions of QNAP QTS and QuTS hero prior to the fixed releases.

Q: Can CVE-2025-66277 be exploited remotely?

Yes, CVE-2025-66277 can be exploited remotely by attackers to gain unauthorized access to unintended file system locations.

Q: Is there a patch available for CVE-2025-66277?

Yes, a patch is available in the form of updates for QTS 5.2.8 and the corresponding updates for QuTS hero.

Published Feb 11, 2026

Updated

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later

Affected Software

39 affected components

QNAP QTS<5.2.8.3350

QNAP QuTS hero<h5.3.2.3354, <h5.2.8.3350

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QTS=5.2.6.3195-build_20250715

QNAP QTS=5.2.6.3229-build_20250818

QNAP QTS=5.2.7.3256-build_20250913

QNAP QTS=5.2.7.3297-build_20251024

QNAP QTS=5.2.8.3332-build_20251128

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

QNAP QuTS hero=h5.2.6.3195-build_20250715

QNAP QuTS hero=h5.2.7.3256-build_20250913

QNAP QuTS hero=h5.2.7.3297-build_20251024

QNAP QuTS hero=h5.2.8.3321-build_20251117

Remediation

Information

Event History

Feb 11, 2026

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-66277?

CVE-2025-66277 is classified as a high severity vulnerability that can allow remote attackers to traverse the file system.

How do I fix CVE-2025-66277?