QNAP Notes Station 3: Container escape via mounted home directory
Summary
Notes Station 3 runs in a container on QNAP NAS devices and mounts a host user's home directory with write access. A local attacker with administrator privileges on the application can escape the container and compromise the security of the NAS. The flaw is not remotely exploitable and requires an administrator account.
Affected
- Notes Station 3 from 3.9.x before 3.9.11 (per CNA record)
- VulDB describes the range as up to 3.9.10
- Default configuration is unaffected according to the CNA record
Fixed in
- Notes Station 3 3.9.11 and later (per vendor statement in CVE record)
- Notes Station 3 3.9.12 also fixes CVE-2026-39991 (stored XSS), per VulDB and HOL
- QNAP advisory ID: Unknown.
Workaround
Unknown. No vendor workaround published; upgrading is the documented fix.
Exploitation
- No known exploitation in the wild; not listed as known-exploited (KEV: No)
- No public exploit available according to VulDB
- CISA SSVC: exploitation none, automatable no, technical impact total
- EPSS: 0.00142 at time of snapshot
Our recommendation
- Check the installed Notes Station 3 version on each QNAP NAS and update to 3.9.12 or later.
- Limit administrator accounts and enforce strong, unique passwords and MFA.
- Check whether the NAS is exposed to the internet and close unneeded port forwarding and UPnP.
- Track the QNAP advisory for PHP2Shell (QSA-26-18), which affects Notes Station 3 and is more urgent, and apply its fixes when released.
- Note: VulDB lists a CVSS base score of 4.2 while the CNA gives 8.4; plan according to the CNA score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP Notes Station 3 release notes www.qnap.com
- VulDB CVE-2026-34009 vuldb.com
- Strix CVE-2026-34009 www.strix.ai
- Vulners CVE-2026-34009 vulners.com
- VulDB CVE-2026-39991 (related XSS fix in 3.9.12) vuldb.com
- HOL CVE-2026-39991 hol.org
- AppleInsider on PHP vulnerabilities affecting NAS devices appleinsider.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:23.
Original description (NVD)
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.