CVE-2026-47790: medium-severity vulnerability in QNAP Systems Inc. QuFTP Service
Privilege Escalation via QuFTP Log-based XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.3%
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.
We have already fixed the vulnerability in the following version:
QuFTP Service 1.4.6 and later
QuFTP Service 1.5.5 and later
QuFTP Service 1.6.5 and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
Affected products
QNAP Systems Inc. · QuFTP ServiceRelated CVEs — QNAP Systems Inc. QuFTP Service
In the same product, most dangerous first.