CVE-2025-53594CWE-22CWE-367CWE-59path-traversal

CVE-2025-53594

published January 2, 2026

CVSS
4.4
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:

Qfinder Pro Mac 7.13.0 and later

Qsync for Mac 5.1.5 and later

QVPN Device Client for Mac 2.2.8 and later

The record
Technical detail
CVSS
4.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00122 · 1.9th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-01-02T21:16Z
References (1)
https://www.qnap.com/en/security-advisory/qsa-25-55 · [email protected]
EPSS history
Timeline
  • 02 JAN 15:18Z
    Qfinder Pro, Qsync, QVPN
    cvelistv5