CVE-2021-44052

An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

• CWE-59
• CWE-59

• https://www.qnap.com/en/security-advisory/qsa-22-16Vendor Advisory
• https://www.qnap.com/en/security-advisory/qsa-22-16Vendor Advisory

Published

May 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44047A use-after-free vulnerability exists when reading a DWF/DWF…7.8
• CVE-2021-44048An out-of-bounds write vulnerability exists when reading a T…7.8
• CVE-2021-44049CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328…7.8
• CVE-2021-4405The ElasticPress plugin for WordPress is vulnerable to Cross…4.3
• CVE-2021-44050CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a …6.5
• CVE-2021-44051A command injection vulnerability has been reported to affec…8.8
• CVE-2021-44053A cross-site scripting (XSS) vulnerability has been reported…6.1
• CVE-2021-44054An open redirect vulnerability has been reported to affect Q…6.1
• CVE-2021-44055An missing authorization vulnerability has been reported to …9.8
• CVE-2021-44056An improper authentication vulnerability has been reported t…9.8
• CVE-2021-44057An improper authentication vulnerability has been reported t…9.8
• CVE-2021-4406An authenticated attacker is able to create alerts that trig…7.2