CVE-2023-51365 is a high severity (CVSS 8.7) path traversal flaw in QNAP QTS, QuTS hero and QuTScloud, a sibling of CVE-2023-51364 in the same advisory. A remote attacker with user access can read unexpected files. The current advisory names QTS 5.1.8.2823 or later for 5.1.x.
What's affected
QNAP's advisory QSA-24-14 lists QTS 5.1.x and 4.5.x, QuTS hero h5.1.x and h4.5.x, and QuTScloud c5.x as affected. The NVD record's fixed versions are QTS 5.1.4.2596 build 20231128, QTS 4.5.4.2627 build 20231225, QuTS hero h5.1.3.2578 build 20231110, QuTS hero h4.5.4.2626 build 20231225 and QuTScloud c5.1.5.2651, each and later.
The current advisory names a newer fixed build for the 5.x lines: QTS 5.1.8.2823 build 20240712 or later and QuTS hero h5.1.8.2823 build 20240712 or later. The 4.5.x and QuTScloud versions match the record. The advisory was revised after the record was written, because it also covers CVE-2024-32765. Use the advisory's newer 5.x builds as your target.
Severity also differs in wording. NVD scores it 8.7 (High), and QNAP rates the advisory Important.
CVSS for this entry is 8.7 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H.
How to check if you're exposed
Log in to the QNAP administration page and open Control Panel, System, Firmware Update to see the installed QTS or QuTS hero build. Compare it with the builds above.
The NAS should also not be reachable from the internet. The advisory says the flaw is exploitable by a remote attacker with user access, so limiting who has accounts and who can reach the web interface reduces your exposure.
What to do now
- Check the firmware version on each QNAP device.
- Update to the latest firmware through Control Panel, System, Firmware Update, using Live Update or a manual download from the QNAP Download Center. QNAP advises checking the product support status page for your model.
- Aim for QTS or QuTS hero 5.1.8.2823 or later on the 5.x lines, or the 4.5.4 builds listed above on 4.5.x.
- Remove unused user accounts, and keep the NAS off the public internet or behind a VPN.
- Review file access logs for unexpected reads of sensitive files.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-22 is path traversal. File paths built from input can point outside the directory the application meant to expose. The fix is to resolve the final path and confirm it stays inside the permitted directory.
CWE-22 is path traversal. File paths built from input can point outside the directory the application meant to expose. QNAP says exploitation could allow users to read the contents of unexpected files and expose sensitive data via a network.
The advisory title references PWN2OWN 2023, a hacking contest, which tells you the finding came from a research event. The record and advisory do not say it is exploited in the wild.
The NVD vector shows high attack complexity and a changed scope, which together give 8.7. Treat the update as a priority for devices that hold business data.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Why do the fixed versions differ between the record and QNAP?
The NVD record lists the builds from the original release. QNAP's advisory was later revised and names QTS 5.1.8.2823 for 5.1.x. Use the advisory.
Does the attacker need an account?
The advisory says a remote attacker with user access could exploit it.
Sources
Last reviewed: 19 October 2026.
