QNAP Qsirch: Path traversal allows reading of unintended files
Summary
QNAP Qsirch, a full-text and semantic search app for QNAP NAS devices, contains a path traversal vulnerability (CWE-22). According to the CNA record, a remote attacker can read the contents of unexpected files or system data. The official description does not mention code execution or authentication, and the CVSS score and third-party wording are inconsistent, so the exact preconditions should be verified.
Affected
- Qsirch 7.0.x before 7.0.3.0
- Default configuration: unaffected (per CNA record)
Fixed in
- Qsirch 7.0.3.0 and later
Workaround
- Unknown. No vendor-published workaround. Upgrading is the fix.
- Until patched, restrict access to the Qsirch web interface to the LAN or VPN and do not expose it to the internet.
Exploitation
- No evidence of active exploitation found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- Not in the CISA KEV catalog. VulDB reports no known exploit. EPSS 0.00429.
Our recommendation
- Inventory all QNAP NAS devices with Qsirch and record the exact version.
- Upgrade anything below 7.0.3.0, preferably to the current supported branch.
- Remove internet exposure of the Qsirch interface and restrict access to LAN or VPN.
- Review NAS and web access logs for unusual requests to Qsirch.
- Check the QNAP advisory and NVD for updated scoring and exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record excerpt (OpenCVE) app.opencve.io
- QNAP Qsirch release notes www.qnap.com
- QNAP Qsirch release notes list www.qnap.com
- VulDB entry vuldb.com
- Vulners CVE entry vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:41.
Original description (NVD)
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.