High severity · published Jan 2, 2026
CVE-2025-62842
HBS 3 Hybrid Backup Sync
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories.
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.2.0.938 and later
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H3
HBS 3 Hybrid Backup Sync · QNAP Systems Inc.
26.1.x before 26.2.0.938 · source: vendor
HB
Hybrid Backup Sync · Qnap
before 26.2.0.938 · source: NVD
In the news
VulnerabilityMedium
ZDI-26-243: (Pwn2Own) QNAP TS-453E write_file_to_svr External Control of File Path Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-62842.
Mar 30, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62842
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-25-46
More from HBS 3 Hybrid Backup Sync
3.3
CVE-2025-62840
HBS 3 Hybrid Backup Sync