CVE-2026-53882: Path Traversal in Virtualization Station VM Import

Q: Who can exploit this vulnerability?

A remote attacker must first obtain a user account on the affected system. The issue could then be exploited to compromise system security.

Q: Which versions are affected or fixed?

QNAP states that Virtualization Station 4.1.1.130 and later includes a fix. Versions earlier than 4.1.1.130 should be treated as affected based on the available information.

Q: What should administrators do?

Update Virtualization Station to version 4.1.1.130 or later. Because exploitation requires a user account, administrators should also review user accounts and access permissions.

Published Oct 15, 2026

Updated

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later

Affected Software

1 affected component

QNAP Virtualization Station<4.1.1.130

Event History

Oct 15, 2026

CVE Published

via MITRE·09:31 AM

Data Sourced

via MITRE·09:31 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

A remote attacker must first obtain a user account on the affected system. The issue could then be exploited to compromise system security.

Which versions are affected or fixed?

QNAP states that Virtualization Station 4.1.1.130 and later includes a fix. Versions earlier than 4.1.1.130 should be treated as affected based on the available information.

What should administrators do?

Update Virtualization Station to version 4.1.1.130 or later. Because exploitation requires a user account, administrators should also review user accounts and access permissions.