CVE-2026-26243: Arbitrary Folder Deletion in Qsync Central 5.0.0.5
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Qsync Centralto a version that resolves this vulnerability.Fixed in 5.0.0.6 - Upgrade
Upgrade
Qsync Centralto a version that resolves this vulnerability.Fixed in 5.1.0.2 - Upgrade
Upgrade
Qsync Centralto a version that resolves this vulnerability.Fixed in 5.2.0.4
Event History
Frequently Asked Questions
Which deployments need to be updated?
Qsync Central versions earlier than 5.0.0.6, 5.1.0.2, or 5.2.0.4 are affected. Update to the fixed release or a later version in the applicable release branch.
What access does an attacker need?
A remote attacker must first obtain a user account. The provided information does not indicate that unauthenticated exploitation is possible.
What can exploitation expose?
An attacker who exploits the path traversal issue can read contents of unintended files or system data. The provided details do not specify particular file paths or data types.