EIP-2026-117806

This is a writeup describing an unquoted service path vulnerability in QNAP QVR Client 5.0.0.13230. The vulnerability allows local privilege escalation if an attacker can place an executable in a path that the service searches for during startup.