CVE-2026-41541— Symlink creation in qsyncsrv.cgi
Quick assessment
Affected
QNAP Systems Inc. Qsync Central
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已报告 Qsync Central 存在一个 Unix 符号链接（symlink）跟随漏洞。如果远程攻击者获得一个用户账户，他们可利用此漏洞破坏系统的安全性。 我们已在以下版本中修复了该漏洞： Qsync Central 5.0.0.7 及更高版本 Qsync Central 5.1.0.3 及更高版本 Qsync Central 5.2.0.5 及更高版本 Qsync Central 5.3.0.2 及更高版本
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1546.001 · Change Default File AssociationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x< 5.0.0.7 |
affected |
5.1.x< 5.1.0.3 |
affected | ||
5.2.x< 5.2.0.5 |
affected | ||
5.3.x< 5.3.0.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41541
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Symlink creation in qsyncsrv.cgi
Source: CVE Program / CVE List V5
Vulnerability Description
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.7 and later
Qsync Central 5.1.0.3 and later
Qsync Central 5.2.0.5 and later
Qsync Central 5.3.0.2 and later
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-61
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x ~ 5.0.0.7 | - |
|
II. Public POCs for CVE-2026-41541
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41541
请登录查看更多情报信息。
Other References for CVE-2026-41541 (1)
Same Patch Batch · QNAP Systems Inc. · 2026-10-15 · 35 CVEs total
| CVE-2026-50612 | 9.4 CRITICAL | Import Symlink Following Remote Code Execution Vulnerability in QuMagie |
| CVE-2026-34006 | 9.3 CRITICAL | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer |
| CVE-2026-50619 | 9.3 CRITICAL | Unauthenticated remote code execution vulnerability |
| CVE-2026-47786 | 9.3 CRITICAL | Pre-Authentication Command Injection |
| CVE-2026-39997 | 8.9 HIGH | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad |
| CVE-2026-39993 | 8.7 HIGH | Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter |
| CVE-2026-34015 | 8.7 HIGH | Remote Code Execution in upload.php of Video Station |
| CVE-2026-41544 | 8.7 HIGH | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/rena |
| CVE-2026-44084 | 8.7 HIGH | Access Code Forgery in Video Station leading to unauthorized media access |
| CVE-2026-53882 | 8.7 HIGH | Path Traversal in Virtualization Station VM Import |
| CVE-2026-41545 | 8.6 HIGH | WebSocket timelapse path traversal and command injection |
| CVE-2026-34008 | 8.5 HIGH | **Privilege Escalation** World-writable crontab path monitored and executed by root-owned |
| CVE-2026-34014 | 8.4 HIGH | ds-move-files.sh is writable and executed as root |
| CVE-2026-34009 | 8.4 HIGH | **Container Escape** Host user home directory mounted with write access into application c |
| CVE-2025-66272 | 7.7 HIGH | Arbitrary file deletion and remote code execution |
| CVE-2025-66275 | 7.7 HIGH | Remote code execution via command injection |
| CVE-2025-68404 | 7.5 HIGH | vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management inte |
| CVE-2026-26243 | 7.2 HIGH | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 |
| CVE-2026-26244 | 7.1 HIGH | SQLi#1 SQL Injection in class_videos.php _getFilters |
| CVE-2026-26245 | 7.1 HIGH | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Qsync Central
-
CVE-2026-26243
Arbitrary Folder Deletion in Qsync Central 5.0.0.5 -
CVE-2026-24718
Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi -
CVE-2025-29897
Stack-based Buffer Overflow in qsyncsrv.cgi -
CVE-2025-29896
NULL Pointer Dereference in qsyncsrv.cgi -
CVE-2025-29895
NULL Pointer Dereference in qsyncsrv.cgi
Same vendor: QNAP Systems Inc.
-
CVE-2026-50619
Unauthenticated remote code execution vulnerability -
CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS -
CVE-2026-47786
Pre-Authentication Command Injection -
CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's -
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file uploa
Same weakness: CWE-61
-
CVE-2026-102740
AsyncHttpClient: Resumable download index store is created w -
CVE-2026-50612
Import Symlink Following Remote Code Execution Vulnerability -
CVE-2026-108981
ngx_cache_purge模块符号链接攻击导致文件删除漏洞 -
CVE-2026-106566
ImageMagick: Policy Bypass in delegate symlink cleanup due t -
CVE-2026-107174
Source-to-image: source-to-image: security boundary bypass v
V. Comments for CVE-2026-41541
No comments yet