EIP-2026-101935

The advisory describes a command injection vulnerability in QNAP Turbo NAS firmware versions 3.6.1 Build 0302T and prior, allowing authenticated attackers to execute arbitrary commands via the 'keyword' or 'title' parameters in the QDownload interface. It also highlights insecure cookie storage of credentials.