QuMagie 2.9.1+ Rel Path Traversal Fixed
CVE-2026-41545 Published on October 15, 2026
WebSocket timelapse path traversal and command injection
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.1 and later
Vulnerability Analysis
CVE-2026-41545 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-41545 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-41545
Want to know whenever a new CVE is published for QNAP Qumagie? stack.watch will email you.
Affected Versions
QNAP Systems Inc. QuMagie:- Version 2.9.x and below 2.9.1 is affected.