CVE-2026-50612

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie

Risk score: 65/100
CVSS: 9.4 v4.0
Exploit chance (30 days): 0.5%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.4 critical

References

https://www.qnap.com/en/app_releasenotes/list.php?app_choose=qumagie

Original description

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later

Last activity 15 Oct 2026. Patch Forecast updates every hour.