A Unix symbolic link following vulnerability in QuMagie allows a remote attacker who has authenticated as a user to manipulate file paths via symbolic links and gain arbitrary code execution or compromise system integrity. This flaw is an instance of improper handling of symbolic links (CWE‑61) and carries the potential for full system compromise when exploited.

QNAP Systems Inc.’s QuMagie application is affected. Any version prior to 2.9.2 is vulnerable; the fix is included in 2.9.2 and later releases. The vulnerability applies to all QuMagie deployments that permit user accounts to access its file handling components.

The CVSS base score of 9.4 highlights the high severity of this flaw, while the EPSS score of less than 1% indicates a low current exploitation probability. It is not yet listed in the CISA KEV catalog, but the attack vector is inferred to be a remote attacker with valid user credentials who can trigger the vulnerable symlink handling routine. With that access, the attacker could execute arbitrary code, read or modify sensitive files, and potentially take full control of the system.