CVE-2026-41545
8.6HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-23, CWE-78
Impact
Remote attackers with an administrator account can read arbitrary system files or unexpected sensitive data. They require administrative access to the QuMagie web interface first.
Root cause
A relative path traversal flaw improperly validates file paths supplied by administrative users.
Affected systems
QuMagie versions prior to 2.9.1.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade QuMagie to version 2.9.1 or later via the QNAP App Center; if patching immediately is not possible, disable the QuMagie app or restrict administrator panel network access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later