The QNAP Pattern: Systemic Security Failures in QTS Plugin Architecture

Original text: “The QNAP Pattern” — Runic Labs. Code blocks, tables, and figures are reproduced verbatim with attribution captions.

Executive Summary

QNAP NAS devices suffer from a recurring class of architectural security failures that go well beyond individual CVEs. Researchers at Runic Labs analyzed four vulnerabilities spanning two plugins—Notes Station 3 and QmailAgent—and found that…

https://core-jmp.org/2026/07/the-qnap-pattern-systemic-security-failures-in-qts-plugin-architecture/