Medium severity · published Jan 2, 2026
CVE-2025-53594
Qfinder Pro, Qsync, QVPN
4.4
CVSS
0.1%
EPSS
No
On KEV
Description
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Qfinder Pro Mac 7.13.0 and later
Qsync for Mac 5.1.5 and later
QVPN Device Client for Mac 2.2.8 and later
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QD
QVPN Device Client for Mac · QNAP Systems Inc.
2.2.x before 2.2.8 · source: vendor
QP
Qfinder Pro Mac · QNAP Systems Inc.
7.13.x before 7.13.0 · source: vendor
QF
Qsync for Mac · QNAP Systems Inc.
5.1.x before 5.1.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53594
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53594
www.qnap.com
https://www.qnap.com/en/security-advisory/qsa-25-55
More from Qfinder Pro Mac
8.6
CVE-2024-53694
QVPN Device Client, Qsync, Qfinder Pro