High severity · published Oct 15, 2026
CVE-2026-41544
Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QC
QcalAgent · QNAP Systems Inc.
1.1.x before 1.1.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41544
www.qnap.com
https://www.qnap.com/en/app-release-notes?keyword=QcalAgent&app=qcalendar&product-line=nas
More from QcalAgent
5.2
CVE-2024-27123
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent