QNAP QuMagie: Symlink following vulnerability allows system compromise
Summary
QuMagie, the photo and video management app for QNAP NAS devices, contains a symbolic link (symlink) following vulnerability. An attacker who holds a valid user account on the NAS can exploit it over the network without user interaction to compromise the security of the system. The CNA rates the issue CRITICAL with CVSS 4.0 9.4, but the vendor text does not confirm remote code execution, and no exploitation has been observed.
Affected
- QuMagie 2.9.x before 2.9.2 (CNA record; VulDB describes the range as up to 2.9.1)
Fixed in
- QuMagie 2.9.2 and later
Workaround
Unknown.
Exploitation
- No known exploitation; CISA SSVC lists exploitation as none and automatable as no.
- No public exploit code confirmed (low-confidence aggregator data).
- EPSS 0.00488 (low). Not listed in CISA KEV.
Our recommendation
- Upgrade QuMagie to version 2.9.2 or later in the QNAP App Center, prioritising NAS devices that are internet-reachable or have shared family or staff accounts.
- If QuMagie is not used, remove the app.
- Limit NAS user accounts to people who need them and use strong, unique passwords.
- Do not expose the NAS administration interface or QuMagie directly to the internet.
- Review other QuMagie flaws from 2026 (CVE-2026-26236, CVE-2026-26237) and keep the NAS firmware and apps up to date.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP QuMagie release notes www.qnap.com
- VulDB CVE-2026-50612 vuldb.com
- OpenCVE CVE-2026-50612 app.opencve.io
- Vulners CVE-2026-50612 vulners.com
- QNAP QuMagie product page www.qnap.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:02.
Original description (NVD)
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.