A cross‑site scripting flaw in QNAP's QuFTP Service allows a remote attacker who has acquired an administrator account to inject malicious scripts into the web interface. The injected code can read application data and potentially bypass existing security checks, creating opportunities for defacement, data theft, or credential hijacking. The weakness is identified as CWE‑79 and is limited to scenarios where privileged credentials are present.

QNAP Systems Inc. provides the QuFTP Service. Any release prior to QuFTP Service 1.4.3, 1.5.2, or 1.6.2 is vulnerable. Users running these older versions should be aware that the issue affects the entire application exposed through the web management console.

The CVSS score is 6.2 and the EPSS score is below 1 %, indicating a medium but existing risk. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have an administrator login; the likely attack vector, inferred from the nature of the flaw, is through the web interface where user‑controlled input is reflected in rendered pages. Given the medium severity and the privileged‑user prerequisite, the overall threat is moderate until the patch is deployed.