Synology Qsync Central 4.5.x Multiple Vulnerabilities Advisory (SQLi/DoS/Path Traversal)

Key Information Vulnerability Overview Security ID: QSA-25-22 Release Date: August 29, 2025 CVE Identifiers: CVE-2025-29893, CVE-2025-29894, CVE-2025-29898, CVE-2025-30260, CVE-2025-30275, CVE-2025-30277, CVE-2025-30278, CVE-2025-33033, CVE-2025-33036, CVE-2025-33037, CVE-2025-33038 Affected Product: Qsync Central 4.5.x Severity: Important Status: Resolved Vulnerability Details CVE-2025-29893, CVE-2025-29894: Remote attackers, after obtaining user account access, can exploit SQL injection vulnerabilities to execute unauthorized code or commands. CVE-2025-29898: Remote attackers, after obtaining user account access, can exploit an uncontrolled resource consumption vulnerability to launch a Denial of Service (DoS) attack. CVE-2025-30260: Remote attackers, after obtaining user account access, can exploit an unrestricted resource allocation or throttling vulnerability to prevent other systems, applications, or processes from accessing the same type of resources. CVE-2025-30275: Remote attackers, after obtaining user account access, can exploit a null pointer dereference vulnerability to launch a Denial of Service (DoS) attack. CVE-2025-30277, CVE-2025-30278: Remote attackers, after obtaining user account access, can exploit an incorrect certificate validation vulnerability to compromise system security. CVE-2025-33033, CVE-2025-33036, CVE-2025-33037, CVE-2025-33038: Remote attackers, after obtaining user account access, can exploit path traversal vulnerabilities to read unintended files or system data. Solution Fixed Version: Qsync Central 4.5.0.7 (released April 23, 2025) and later versions Recommended Actions Update Qsync Central to the latest version to remediate the vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Synology Qsync Central 4.5.x Multiple Vulnerabilities Advisory (SQLi/DoS/Path Traversal)