https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-69431.htmlhttps://patchthecve.com/cve/CVE-2025-69431.htmlWed, 17 Jun 2026 10:00:42 +0000MEDIUM 6.1: The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access the USB drive's directory mounted on the NAS using the Samba https://patchthecve.com/cve/CVE-2025-15133.htmlhttps://patchthecve.com/cve/CVE-2025-15133.htmlWed, 07 Oct 2026 12:10:00 +0000MEDIUM 6.3: A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit https://patchthecve.com/cve/CVE-2025-15132.htmlhttps://patchthecve.com/cve/CVE-2025-15132.htmlWed, 07 Oct 2026 12:10:00 +0000MEDIUM 6.3: A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has behttps://patchthecve.com/cve/CVE-2025-15131.htmlhttps://patchthecve.com/cve/CVE-2025-15131.htmlWed, 07 Oct 2026 12:10:00 +0000MEDIUM 6.3: A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made publihttps://patchthecve.com/cve/CVE-2025-14108.htmlhttps://patchthecve.com/cve/CVE-2025-14108.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 8.8: A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate thttps://patchthecve.com/cve/CVE-2025-14107.htmlhttps://patchthecve.com/cve/CVE-2025-14107.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 8.8: A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attahttps://patchthecve.com/cve/CVE-2025-14106.htmlhttps://patchthecve.com/cve/CVE-2025-14106.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 8.8: A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried ou