QNAP Systems Inc. Notes Station 3 vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting QNAP Systems Inc. Notes Station 3: 4 record(s), with affected versions and fixes.

CVE-2026-39991 Medium · 4.8 CWE-79 Oct 15, 2026

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

CVE-2026-34009 High · 8.4 CWE-653 Oct 15, 2026

**Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34008 High · 8.5 CWE-732 Oct 15, 2026

**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34007 Medium · 6.9 CWE-78 Oct 15, 2026

**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later