The vulnerability is a cross‑site scripting flaw that allows a malicious user to inject and execute arbitrary JavaScript and possibly other code when the interface processes log content. When an attacker has a valid user account, they can craft input that is reflected into the web interface, enabling the code to run in the context of the logged‑in user. This could allow the attacker to deface pages, steal session cookies or perform further actions with the privileges of that account. The flaw does not provide direct unauthenticated remote code execution, but code execution is achieved as long as an authenticated session exists.

QNAP Systems Inc. provides the QuFTP Service, a component of its NAS product line. All versions of QuFTP Service released before 1.4.6, 1.5.5 or 1.6.5 are vulnerable. Users should verify that their deployed version satisfies at least 1.4.6, 1.5.5 or 1.6.5 depending on which product line they are running.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests attackers are unlikely to target it in mass exploitation campaigns. QuNAP has not listed this vulnerability in the CISA KEV catalog, meaning no widespread exploitation is reported. The attack requires a legitimate user account, implying a limited threat surface that can be mitigated by disabling the service or enforcing stricter account controls until a patch is applied.