-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2026-015 Product: QNAP File Station 5 Manufacturer: QNAP Systems, Inc. Affected Version(s): < 5.5.6.5208 Tested Version(s): 5.2.8.3359 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2026-03-02 Solution Date: 2026-04-15 Public Disclosure: 2026-07-22 CVE Reference: CVE-2026-26241 Author of Advisory: Moritz Abrell, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: QTS is the operating system used on QNAP NAS devices and includes the File Station 5 application. A stack-based buffer overflow exists in utilRequest.cgi in combination with libuLinux_cgi.so, originating from a fixed buffer size and a strcpy() of user-controlled data. This can be exploited by any low-privileged user with write access to at least one directory within the FileManager, e.g. the user's "home" directory. It is also exploitable by unauthorized attackers if a directory is shared through share.cgi and the share id (ssid) is known. The user-supplied multipart/form-data parameter "filename" is copied into a fixed 272-byte stack buffer via strcpy(), overflowing the buffer and adjacent stack objects. Further exploitation allows manipulating adjacent stack variables, which could potentially lead to program manipulation or remote code execution. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The GET parameter "func=chunked_upload" calls a handler function in utilRequest.cgi, which allows users to upload files in chunks to their writable locations on the NAS through the FileManager. This function is also reachable via share.cgi. For the multipart/form-data parameter "filename", a fixed buffer of 272 bytes is allocated on the stack (char local_1e78[272]). The handler calls "WFM2_CGI_Upload_CB", imported from the shared object libuLinux_cgi.so.0. This imported function internally calls a save function (FUN_00108600), which does the following: pcVar16 = (char *)parser_upload_filename(local_1e78); strcpy(local_1e78,pcVar16); The function "parser_upload_filename()" sanitizes the user-supplied filename by looking for the last "/" or "\" character and returning a pointer to the actual filename. However, this does not prevent the following strcpy from overflowing the buffer, since the filename can still be valid and contain an attacker-controlled amount of data, e.g. a string with 272 'A's ("AAAAA..."). This results in overflowing the fixed buffer if the filename length is ≥ 272 bytes. The same vulnerable code path is also reachable via share.cgi, which is used when a folder is shared externally via a share link. If an attacker knows the ssid and the share has upload permissions enabled, the overflow can be triggered without authentication on the NAS itself. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Via utilRequest.cgi (authenticated low-privileged user): POST /cgi-bin/filemanager/utilRequest.cgi?func=chunked_upload&upload_id=tmpagbECD&filesize=4&upload_name=test.txt&mtime=1772178704&ssid=f094ef1662a642359feb662eca9f6a09&upload_root_dir=/&dest_path=/&offset=0&settime=1&ep=&overwrite=1 HTTP/1.1 Host: 192.168.178.188:8080 Content-Length: 12568 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="fileName" test123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="file"; filename="AAA ... (>256 bytes)" Content-Type: text/plain 123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ-- 2. Via unauthenticated share.cgi where ssid is known: POST /share.cgi?func=chunked_upload&upload_id=tmpagbECD&filesize=4&upload_name=test.txt&mtime=1772178704&sid=m3m62dp3&upload_root_dir=/&dest_path=/&offset=0&settime=1&ep=&overwrite=1 HTTP/1.1 Host: 192.168.178.188:8080 Content-Length: 12568 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="fileName" test123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ Content-Disposition: form-data; name="file"; filename="AAA ... (>256 bytes)" Content-Type: text/plain 123 - - ------WebKitFormBoundaryYJUxywWLq9wtWArJ-- The filename parameter exceeds 272 bytes, causing the strcpy() in the internal save function to overflow the stack buffer and corrupt adjacent stack objects. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update to version 5.5.6.5243 or later (see [4] and [5]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-02-25: Vulnerability discovered 2026-03-02: Vulnerability reported to the manufacturer 2026-03-05: Vulnerability confirmed by the manufacturer 2026-04-15: Fixed version published by the manufacturer (see [4]) 2026-06-10: Security advisory published by the manufacturer (see [5]) 2026-07-22: Public disclosure ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] QNAP QTS product page https://www.qnap.com/en/operating-system/qts [2] SySS Security Advisory SYSS-2026-015 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-015.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] File Station 5 Relase Notes: https://www.qnap.com/en/app-release-notes?app=FileStation5&product-line=nas [5] Manufacturer Security Advisory: https://www.qnap.com/uploads/security-advisories/QSA-26-10/CVE-2026-26241.json ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Moritz Abrell of SySS GmbH. E-Mail: moritz.abrell@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc Key Fingerprint: 2927 7EB6 1A20 0679 79E9 87E6 AE0C 9BF8 F134 8B53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory should be published by the author. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpY5UkACgkQrgyb+PE0 i1N79g/+MXnDDT4k2D4Q1Eoc7/lGXs3aGt9F4tXgzV1YicsEAxTxo3k+AuokFBGv 3LCQ6hwR/KhEKwXNZWfbJplziOZm5NKXmoK6IhU6jG6uOXudUn2cN1oRzNv8YDbL rdTUfRcOrgim7ZjgHSiWVuLx07Rex9WtyfMsa8Eh68a/gUKsfgaF7tmCX9oK5vDz remUeLu0Pcx6J3nQpbwY7B5pm9SdWgKFrrVBqk87HDiRoAAIEmkp0F9MEx/XFac2 NJnivF/a3hIessHmn/VFzHvb/nxCdq894R54HtliMQX3B9tERlKz7cK5Yl5Fx/95 1Y1IweAi2WkCcdcVbZoaL00MEHE9YUllulzgFSPwPjMJDTL/X2ShKtDF644QfMV9 5qEc9N12clQxvZiMJvcwsFFRzC4r0r5UZGw26PIsijyS6c2FkMWOwWAg4sPXD6FI 9CqR3Lc7HD/yHNmlD3ok0UFnbw3RiHvNylMtFn9BQTcnPypGaFFT78EgW00sG3vz kptaJo1liWh0TPS7EVrcKI1pzJ8o1llTVuziUqTNOhp0uWqMDWmP/CLifQWDSoUi ICDnHJ41j/n3FdmEdhe0BfC2ZHuhdp6WIJC7MdtyKOE9zNO+DXwXukpOQZhL0kVi GfWkEsiIxuhQGsz+WY0K7+jzGhDwBgMbpdbGgr+B2Lfu5qBfpig= =lZFj -----END PGP SIGNATURE-----