CVE-2026-34007: **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Affected Software
Event History
Frequently Asked Questions
Which versions are affected and which version contains the fix?
The issue affects Notes Station 3 versions before 3.9.11. QNAP states that Notes Station 3 3.9.11 and later include the fix.
What access does an attacker need to exploit this issue?
The reported impact is remote arbitrary command execution. The available information does not state whether authentication, a particular network position, or a specific configuration is required.
What component should be prioritized for remediation?
Prioritize updating QNAP Notes Station 3 to version 3.9.11 or later. The reported vulnerable path involves handling of the X-Forwarded-For header and command execution through shell_exec().