cve.nowby Sazabi
← All vulnerabilities
CVE-2026-50612

Import Symlink Following Remote Code Execution Vulnerability in QuMagie

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 2.9.2
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later

Affected versions

  • QNAP Systems Inc. QuMagie

    From 2.9.x · fixed in 2.9.2

References 1

qnap.com