External risk intelligence

Qsirch Path Traversal Allows Reading Unexpected Files

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-50619

Qsirch is a full-text search application for QNAP NAS devices. These storage appliances are frequently deployed as internet-facing network-attached storage or management portals, making their web-based applications and search services commonly reachable from the public internet in real-world environments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Qsirch that could allow remote attackers to access sensitive system data. The issue has been addressed in updated versions of the software. The main concern is confirming if this technology is in use and if it is exposed.

Attackers can read unexpected files remotely.
This affects a QNAP search application.
Confirm QNAP Qsirch use and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a path traversal vulnerability in Qsirch by sending specially crafted requests to the application. This could allow them to read files outside of the intended directory, potentially exposing sensitive system data.

No access or authentication required.
Triggered by sending malicious requests.
Risk of unauthorized file disclosure.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in Qsirch could allow remote attackers to read unexpected files or system data when supported by the advisory.

System data could be accessed.
Attackers could read unexpected files.
Sensitive information disclosure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Qsirch, a search application for QNAP NAS devices, requires immediate attention. Given that QNAP devices are often internet-facing, application owners and infrastructure teams must first identify all instances of Qsirch, assess their exposure and business criticality, and confirm their responsible owners. Remediation planning should then be prioritized based on this risk assessment.

Application owners must prioritize this issue.
Verify Qsirch instances and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Qsirch and what is it used for?

Qsirch is a full-text search engine application designed for QNAP network-attached storage (NAS) devices. It helps users quickly locate files, documents, and media across their storage volumes by indexing the content. It acts as an internal search tool that runs directly on the storage appliance hardware.

What does path traversal mean for CVE-2026-50619?

This vulnerability, classified as CWE-22, occurs when an application fails to properly filter user input used to define file paths. Normally, software should restrict access to specific folders. Because of this flaw in Qsirch, an attacker can use special characters in a request to 'escape' those boundaries and read files elsewhere on the underlying system that they should not be able to access.

How is this Qsirch vulnerability triggered?

An attacker triggers the vulnerability by sending a specially crafted request to the Qsirch application over the network. Crucially, this does not require the attacker to have an existing account or password, nor does it require any pre-existing interaction from a legitimate user. Sending normal, non-malicious search queries will not trigger this flaw.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, Qsirch instances are often hosted on QNAP devices that are directly internet-facing or reachable via web management portals. This high level of network accessibility means that if your QNAP NAS is reachable from the public internet, the risk is significantly elevated compared to a device restricted to a private, internal-only network.

What should I do to address CVE-2026-50619?

First, identify all QNAP devices in your environment running Qsirch to determine if they are exposed to the internet. After assessing the criticality of those instances, you should move to install the vendor-provided update, as this vulnerability is resolved in Qsirch version 7.0.3.0 and all subsequent releases.

References

www.qnap.com/en/app-release-notes?keyword=Qsirch&app=Qsirch&produc…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.