CVE-2026-41545: WebSocket timelapse path traversal and command injection

Q: Who is exposed to exploitation?

QuMagie deployments are exposed if a remote attacker has obtained an administrator account. The reported impact includes reading unexpected files or system data.

Q: What access does an attacker need?

The attacker must first gain an administrator account and be able to access the target remotely. The provided information does not describe exploitation by unauthenticated or non-administrative users.

Q: Which versions are fixed?

The vulnerability is fixed in QuMagie 2.9.1 and later.

Published Oct 15, 2026

Updated

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

Affected Software

1 affected component

QNAP Qumagie<2.9.1

Event History

Oct 15, 2026

CVE Published

via MITRE·09:31 AM

Data Sourced

via MITRE·09:31 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Who is exposed to exploitation?

QuMagie deployments are exposed if a remote attacker has obtained an administrator account. The reported impact includes reading unexpected files or system data.

What access does an attacker need?

The attacker must first gain an administrator account and be able to access the target remotely. The provided information does not describe exploitation by unauthenticated or non-administrative users.

Which versions are fixed?

The vulnerability is fixed in QuMagie 2.9.1 and later.