A cross‑site scripting vulnerability exists in QNAP’s QuFTP Service. When an attacker obtains an administrator account, they can insert malicious scripts that run in the context of the service, enabling them to bypass controls or read application data. The flaw is identified as CWE‑79.

The affected product is QNAP Systems Inc.’s QuFTP Service. All releases prior to the patched versions 1.4.3, 1.5.2 and 1.6.2 are vulnerable. Updated releases containing these patches should be deployed to any environment running the service.

The CVSS score of 2.2 reflects low technical severity, but the requirement for administrator access raises the practical risk. Exploitation is remote and depends on privileged credentials. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. If an administrator account is compromised or exposed, the risk to confidentiality and integrity increases significantly.