An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories.
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.2.0.938 and later
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.2.0.938 and later
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.2.0.938 and later
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-25-46 |
|
History
Fri, 02 Jan 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.2.0.938 and later | |
| Title | HBS 3 Hybrid Backup Sync | |
| First Time appeared |
Qnap Systems Inc.
Qnap Systems Inc. hbs 3 Hybrid Backup Sync |
|
| Weaknesses | CWE-73 | |
| CPEs | cpe:2.3:a:qnap_systems_inc.:hbs_3_hybrid_backup_sync:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Qnap Systems Inc.
Qnap Systems Inc. hbs 3 Hybrid Backup Sync |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: qnap
Published:
Updated: 2026-01-02T15:51:40.904Z
Reserved: 2025-10-24T02:43:45.372Z
Link: CVE-2025-62842
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-01-02T16:17:00.710
Modified: 2026-01-02T16:45:26.640
Link: CVE-2025-62842
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses