CVE-2021-38693

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

• CWE-22
• CWE-22

• https://www.qnap.com/en/security-advisory/qsa-22-13Vendor Advisory
• https://www.qnap.com/en/security-advisory/qsa-22-13Vendor Advisory

Published

May 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38688An improper authentication vulnerability has been reported t…7.5
• CVE-2021-38689A stack buffer overflow vulnerability has been reported to a…9.8
• CVE-2021-3869corenlp is vulnerable to Improper Restriction of XML Externa…7.5
• CVE-2021-38690A stack buffer overflow vulnerability has been reported to a…9.8
• CVE-2021-38691A stack buffer overflow vulnerability has been reported to a…9.8
• CVE-2021-38692A stack buffer overflow vulnerability has been reported to a…9.8
• CVE-2021-38694SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.7.5
• CVE-2021-38695SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cros…5.4
• CVE-2021-38696SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control…7.5
• CVE-2021-38697SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unres…9.8
• CVE-2021-38698HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endp…6.5
• CVE-2021-38699TastyIgniter 3.0.7 allows XSS via /account, /reservation, /a…5.4