QNAP Virtualization Station: Link following in VM import allows file access
Summary
A link-following weakness (CWE-59) in the VM Import function of QNAP Virtualization Station can be exploited by an attacker with a valid user account on the NAS. The flaw can be used to access files outside the intended path, which the CNA rates as high impact for confidentiality, integrity and availability. No public proof of concept or in-the-wild exploitation has been reported, and CISA SSVC rates exploitation as none.
Affected
- QNAP Virtualization Station 4.1.x before 4.1.1.130
- Whether older branches are affected is unknown.
Fixed in
- Virtualization Station 4.1.1.130 and later
Workaround
Unknown.
- Until patched, limit which accounts exist on the NAS and restrict access to the management interface.
Exploitation
- No public proof of concept known (VulDB).
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- No in-the-wild reports found.
Our recommendation
- Inventory all QNAP NAS units running Virtualization Station and their versions.
- Upgrade to 4.1.1.130 or later after confirming the version in the QNAP release notes.
- Review user accounts on affected devices and remove unused ones.
- Do not expose the NAS admin interface to the internet.
- Recheck NVD, CISA KEV and the QNAP advisory list for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP Release Notes (QKVM) www.qnap.com
- OpenCVE CVE-2026-53882 app.opencve.io
- VulDB 420595 vuldb.com
- Vulners CVE-2026-53882 vulners.com
- ThreatInt CVE-2026-53882 cve.threatint.com
- Strix CVE-2026-53882 www.strix.ai
- OffSeq Radar CVE-2026-53882 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:31.
Original description (NVD)
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.