QNAP Patches High-Severity SQL Injection and Path Traversal Flaws

QNAP has issued a sweeping set of security advisories patching two high-severity flaws and several lower-severity bugs. The two high-severity flaws are CVE-2025-59384 in Qfiling Path Traversal and CVE-2025-59387 in MARS SQL Injection, both rated CVSS 8.1 and allowing remote attackers to read the contents of unexpected files or system data or to execute unauthorized code or commands.

Mac users are urged to update as a path traversal vulnerability (CVE-2025-53594) affects Qfinder Pro, Qsync and the QVPN Device Client for macOS, with fixed versions listed for each. Additional fixes address CVE-2025-52871 out-of-bounds read and CVE-2025-53597 buffer overflow in License Center, fixed in License Center 2.0.36. The advisories state that remote attackers could gain deep access or obtain secret data, and QNAP recommends logging in to the administrator interface and applying updates immediately.

According to QNAP, the updates cover software from Mac-based client utilities to core backend services like Qfiling and the Multi-Application Recovery Service (MARS), and the article notes the fixes include Qfiling 3.13.1 and later and MARS 1.2.1.