CVE-2026-39991: Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

Q: What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The issue can then be exploited remotely to inject malicious code through the file upload functionality.

Q: Which versions are fixed?

QNAP states that Notes Station 3 version 3.9.12 and later contains the fix.

Published Oct 15, 2026

Updated

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

Affected Software

1 affected component

QNAP Notes Station 3<3.9.12

Event History

Oct 15, 2026

CVE Published

via MITRE·09:37 AM

Data Sourced

via MITRE·09:37 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The issue can then be exploited remotely to inject malicious code through the file upload functionality.

Which versions are fixed?

QNAP states that Notes Station 3 version 3.9.12 and later contains the fix.