The disclosed vulnerability is a relative path traversal that can be leveraged through the WebSocket timelapse interface of QNAP's QuMagie application. An attacker who obtains administrative credentials can manipulate the file path parameter and read files outside the intended directory, potentially exposing sensitive system information. The title also references command injection, implying that traversal might be combined with the ability to execute arbitrary shell commands if properly crafted, although the description does not elaborate on this capability.

The flaw affects QNAP Systems' QuMagie software for all versions released prior to 2.9.1. Versions 2.9.1 and newer contain the fix. Administrators who have created or maintained QuMagie on QNAP devices should verify the installed version and upgrade if necessary.

With a CVSS score of 8.6, the vulnerability poses a high severity risk. The EPSS score is below 1%, indicating that, so far, it has not been widely exploited in the wild, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, exploiting it requires only a valid administrator account and a WebSocket connection, which could be obtained by social engineering or credential compromise. Once triggered, an attacker could read arbitrary files or potentially exploit other weaknesses, depending on the presence of injection flaws.