An authenticated local attacker with administrator privileges can exploit a path traversal flaw in QNAP License Center, allowing the reader to resolve and access arbitrary file paths outside the intended directory. This flaw can expose sensitive configuration files, system data, or other protected content, potentially compromising confidentiality of the host. The weakness falls under CWE‑22, indicating unvalidated file path traversal.

QNAP Systems Inc. License Center versions prior to 1.9.56, specifically 1.9.55 and earlier, are vulnerable. The issue was fixed in the 1.9.56 release and later. Only installations of License Center that have not been updated to at least 1.9.56 are at risk.

With a CVSS base score of 4.6, the vulnerability is considered moderate. The EPSS score is 0.00246, indicating a very low but non‑zero likelihood of exploitation, and it is not listed in the CISA KEV catalog. Because exploitation requires local administrator access, the attack surface is limited to users who already have administrative privileges. If such access is obtained, the attacker can read arbitrary files, but remote exploitation and privilege escalation are not possible.