QNAP QuMagie EUVD-2026-101981

Exploitation requires the attacker to first possess a valid QuMagie user account (PR:L) - the description explicitly states the attacker must 'gain a user account' before exploiting the symlink-following behavior. The attacker then needs the ability to create or influence a symbolic link that a QuMagie file operation will follow (CWE-61), typically via an uploaded or user-controlled path within the photo app. No user interaction by a victim is required (UI:N) and the attack is low-complexity (AC:L) once an account is held. The primary limiting factor is authentication: single-admin appliances or instances where untrusted users cannot obtain QuMagie accounts are not exploitable by anonymous remote attackers. The exact QuMagie feature/version boundary is not specified beyond 'fixed in 2.9.2 and later', so pre-2.9.2 installations with multiple or externally-reachable user accounts are the realistic exposure.

This is a credible high-priority issue but with an important access caveat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 9.4 (Critical) with full high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), consistent with a symlink-following flaw (CWE-61) that lets a low-privileged user escape intended file boundaries and compromise the underlying NAS. The key mitigating signal is PR:L: the vector and the description agree that the attacker must first obtain a valid user account ('if a remote attacker gains a user account'), so this is NOT a pre-auth remote flaw. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so there is no evidence of active exploitation or available POC at this time. The result is a flaw that is severe in impact but gated behind authentication - real priority for internet-exposed QuMagie/QNAP instances with multiple or weakly-secured user accounts, lower priority for appliances with a single trusted admin and no remote account access. Note the input Tag 'Information Disclosure' understates the impact: the CVSS vector claims full integrity and availability compromise, not merely confidentiality - treat it as a full-compromise issue.

An attacker who holds or obtains a low-privileged QuMagie user account (e.g., a shared or compromised photo-app login) creates or manipulates a symbolic link so that a QuMagie file operation follows the link to a sensitive location outside the intended directory. By doing so they read, overwrite, or plant files as the service account, escalating to compromise of the host NAS. No public exploit code was identified in the provided data.