CVE-2026-47790: Privilege Escalation via QuFTP Log-based XSS

Q: What does an attacker need before they can exploit this issue?

The attacker must first obtain a user account on the affected QuFTP Service instance. The reported attack path then allows that authenticated remote user to inject malicious code through the XSS vulnerability.

Q: Which QuFTP Service releases contain the fix?

The vulnerability is fixed in QuFTP Service 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later.

Published Oct 15, 2026

Updated

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.

We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later

Affected Software

1 affected component

QNAP QuFTP Service<1.4.6, <1.5.5, <1.6.5

Event History

Oct 15, 2026

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What does an attacker need before they can exploit this issue?

The attacker must first obtain a user account on the affected QuFTP Service instance. The reported attack path then allows that authenticated remote user to inject malicious code through the XSS vulnerability.

Which QuFTP Service releases contain the fix?

The vulnerability is fixed in QuFTP Service 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later.