A symlink following flaw in Qsync Central allows a remote attacker who has obtained a user account to walk outside the intended file system boundaries. By exploiting this weakness, the attacker can read or modify system files that are normally protected, potentially compromising the confidentiality, integrity, and availability of the NAS device and the data it stores.

The vendor QNAP Systems Inc. supplies Qsync Central software for its devices. Versions earlier than Qsync Central 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 are vulnerable. All releases released before the specified patch levels remain affected.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. With an EPSS score of less than 1%, exploitation probability is deemed very low. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote via a valid user session; an attacker would need to authenticate to Qsync Central before leveraging the symlink flaw to gain further privileges.