CVE-2026-47790 Overview
CVE-2026-47790 is a cross-site scripting (XSS) vulnerability affecting QNAP QuFTP Service. An authenticated remote attacker can inject malicious script content that executes in the context of other users accessing the application. The weakness falls under [CWE-79], improper neutralization of input during web page generation.
QNAP has released fixes in QuFTP Service 1.4.6, 1.5.5, and 1.6.5 and later across the maintained branches. Exploitation requires a valid user account on the target NAS, limiting unauthenticated exposure but still enabling session hijacking, credential theft, or persistence inside the management interface.
Critical Impact
An authenticated attacker can execute arbitrary JavaScript in another user's browser session, potentially compromising administrative accounts and the NAS they manage.
Affected Products
- QNAP QuFTP Service versions prior to 1.4.6 (1.4.x branch)
- QNAP QuFTP Service versions prior to 1.5.5 (1.5.x branch)
- QNAP QuFTP Service versions prior to 1.6.5 (1.6.x branch)
Discovery Timeline
- 2026-10-15 - CVE CVE-2026-47790 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-47790
Vulnerability Analysis
The flaw is a stored or reflected XSS condition in the QuFTP Service web interface. QuFTP is the FTP management application for QNAP NAS devices, providing user, share, and transfer configuration through a browser-based console.
QuFTP accepts user-supplied input that is later rendered into HTML responses without sufficient encoding. When an authenticated attacker submits crafted payloads containing script content, the application reflects or stores those payloads in pages viewed by other operators.
The injected script runs under the origin of the NAS management interface. This exposes session cookies, CSRF tokens, and any administrative actions the victim's browser can perform against the QNAP device.
Root Cause
The root cause is missing output encoding on fields handled by QuFTP Service. User-controlled values are placed into HTML, attribute, or JavaScript contexts without context-appropriate sanitization. QNAP's advisory confirms the issue is resolved by updating to the fixed releases, indicating input handling and output encoding logic were corrected in the affected view components.
Attack Vector
Exploitation requires network access to the NAS management interface and a valid, low-privilege user account. The attacker submits a payload through a QuFTP input field. When an administrator or another user loads the affected page, the browser executes attacker-controlled JavaScript.
The attacker can then exfiltrate session material, pivot to higher-privileged QNAP functions, modify FTP configurations, or stage follow-on attacks against stored files. User interaction from the victim is required to trigger execution. See the vulnerability description for additional vendor context.
Detection Methods for CVE-2026-47790
Indicators of Compromise
- QuFTP configuration fields, user profile data, or share descriptions containing <script>, onerror=, onload=, or encoded JavaScript payloads.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading QuFTP pages.
- New or modified QuFTP user accounts, permission changes, or FTP shares created by legitimate administrator sessions without corresponding ticket activity.
Detection Strategies
- Review QuFTP Service logs and QNAP system logs for anomalous input submissions from low-privilege accounts.
- Inspect stored QuFTP configuration data for HTML or JavaScript syntax in fields that should contain plain text.
- Correlate administrator browser activity with QuFTP page loads to detect post-exploitation session abuse.
Monitoring Recommendations
- Monitor QNAP NAS management interfaces for authentication by accounts that should not interact with QuFTP.
- Alert on QuFTP Service version strings below 1.4.6, 1.5.5, or 1.6.5 across the NAS fleet.
- Capture and retain web proxy or NAS access logs to support investigation of browser-side execution events.
How to Mitigate CVE-2026-47790
Immediate Actions Required
- Upgrade QuFTP Service to 1.4.6, 1.5.5, 1.6.5, or later depending on the installed branch, following QNAP's QuFTP Service Release Notes.
- Audit QuFTP user accounts and remove unused or shared credentials that could be leveraged for authenticated exploitation.
- Review QuFTP configuration fields for suspicious content and sanitize any entries containing script syntax.
Patch Information
QNAP has published fixed releases for each supported QuFTP Service branch. Install 1.4.6, 1.5.5, or 1.6.5 and later through the QNAP App Center. The vendor advisory is linked from the QNAP QuFTP Service Release Notes.
Workarounds
- Restrict QuFTP Service access to trusted administrators until the update is applied.
- Place the NAS management interface behind a VPN or network segment that limits exposure to untrusted users.
- Enforce least privilege on QNAP accounts and disable QuFTP for users who do not require FTP management.
# Verify installed QuFTP Service version on a QNAP NAS
qpkg_cli --list | grep -i QuFTP
# After updating via App Center, confirm the fixed version
qpkg_cli --version QuFTP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
