---
id: CVE-2025-59389
title: >-
  An SQL injection vulnerability has been reported to affect Hyper Data
  Protector
summary: >-
  An SQL injection vulnerability has been reported to affect Hyper Data
  Protector. The remote attackers can then exploit the vulnerability to execute
  unauthorized code or commands.


  We have already fixed the vulnerability in the following …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: qnap
product: hyper_data_protector
affected:
  - 'hyper_data_protector >= 2.1.0.0226, < 2.2.4.1'
  - hyper_data_protector = 2.0.0.1115
patched:
  - hyper_data_protector 2.2.4.1
published: '2026-01-02'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:10:00.297'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59389'
references:
  - url: 'https://www.qnap.com/en/security-advisory/qsa-25-48'
    label: security@qnapsecurity.com.tw
tags:
  - nvd
epss: 0.00691
epssPercentile: 0.51758
ingestedAt: '2026-10-14T19:49:57.547Z'
---

## Overview

An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following versions:
Hyper Data Protector 2.2.4.1 and later

## Affected

- `hyper_data_protector >= 2.1.0.0226, < 2.2.4.1`
- `hyper_data_protector = 2.0.0.1115`

## Remediation

Upgrade past the affected range:

- `hyper_data_protector 2.2.4.1`