Vulnerabilidades do QNAP Systems Inc. Notes Station 3

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam QNAP Systems Inc. Notes Station 3: 4 registro(s), com versões afetadas e correções.

CVE-2026-39991 Média · 4.8 CWE-79 15/10/2026

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

CVE-2026-34009 Alta · 8.4 CWE-653 15/10/2026

**Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34008 Alta · 8.5 CWE-732 15/10/2026

**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34007 Média · 6.9 CWE-78 15/10/2026

**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later