Administrator-authenticated file disclosure via path traversal

Path traversal in QNAP QTS 5.2.x and QuTS hero h5.2.x allows remote authenticated users with administrator access to read unexpected files. QNAP has not disclosed the affected endpoint or code locus, beyond stating that path traversal permits access to files or system data outside the expected location. Exploitation requires an administrator account, and the reported consequence is read-only disclosure rather than file modification or service interruption.