CVE-2025-66277 is a critical link following flaw (CVSS 9.8) in QNAP QTS and QuTS hero. Remote attackers can traverse the file system to unintended locations. Fixed in QTS 5.2.8.3350 build 20251216, QuTS hero h5.3.2.3354 build 20251225 and QuTS hero h5.2.8.3350 build 20251216, and later.
What's affected
- QNAP QTS and QuTS hero. QNAP says several operating system versions are affected.
- Fixed: QTS 5.2.8.3350 build 20251216 and later.
- Fixed: QuTS hero h5.3.2.3354 build 20251225 and later.
- Fixed: QuTS hero h5.2.8.3350 build 20251216 and later.
How to check if you're exposed
Open Control Panel, then System, then Firmware Update on each NAS and read the installed version. Match it against the three fixed builds above, using the line your device runs (QTS, QuTS hero 5.3 or QuTS hero 5.2).
The record does not give the lower bound of affected versions. QNAP advisory QSA-26-05 is the place to confirm whether an older release is in scope.
What to do now
- Inventory QNAP devices and note the operating system and build.
- Apply the fixed build for your line, or a newer one.
- Keep management and file sharing interfaces off the public internet.
- Review QSA-26-05 for the exact affected range.
- Verify the firmware version after the update completes.
Firmware updates on a NAS can take the device offline for a few minutes, so schedule them for a quiet window and check that backups completed first. After the update, confirm that shares, snapshots and scheduled jobs came back as expected. If you run both QTS and QuTS hero units, track them separately, because the fixed builds differ.
Why it matters
The weakness is CWE-59, improper link resolution before file access. Software follows a symbolic link or similar pointer without checking where it leads, so a request meant for one folder ends up reading or writing somewhere else.
On a NAS that can mean files outside the share an application was supposed to touch. With no authentication needed per the vector, exposure to the internet turns a design bug into a data risk. The record does not list this CVE as exploited in the wild.
Quick check
What class of bug is CVE-2025-66277?
A link following flaw, CWE-59. The software resolves a link to an unintended file system location, which allows traversal.
Sources
Last reviewed: 19 October 2026.
