A path traversal flaw exists in QNAP’s QcalAgent that allows a remote attacker who has obtained a valid user account to read arbitrary files on the system. The flaw also permits moving files, potentially escaping the Docker container and executing code on the host. This combination exposes the system to complete takeover if exploited successfully.

The vulnerability affects QNAP Systems Inc.’s QcalAgent, specifically all releases earlier than 1.1.10. Devices running any of these affected versions are susceptible until the patch is applied.

The CVSS score of 8.7 indicates high severity, while the EPSS of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have a valid user session and to target the /calapi/renameUpload endpoint, after which file manipulation can lead to a Docker escape and remote code execution.