CVE-2026-41545
Last modified
CVE-2026-41545 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QuMagie | >= 2.9.x, < 2.9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-41545?
How severe is CVE-2026-41545?
How do I fix CVE-2026-41545?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4153GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code…7.8
- CVE-2026-41530The automatic folder creation feature of Lhaz and Lhaz+ prov…4.6
- CVE-2026-41539A cross-site scripting (XSS) vulnerability has been reported…6.1
- CVE-2026-4154GIMP XPM File Parsing Integer Overflow Remote Code Execution…7.8
- CVE-2026-41541An unix symbolic link (symlink) following vulnerability has …5.3
- CVE-2026-41544A path traversal vulnerability has been reported to affect Q…8.7
- CVE-2026-4155ChargePoint Home Flex Inclusion of Sensitive Information in …7.5
- CVE-2026-41551A vulnerability has been identified in ROS# (All versions < …9.1
- CVE-2026-41552PDF Export Module used in DHTMLX's products Gantt and Schedu…7.5
- CVE-2026-41553PDF Export Module used in DHTMLX's products Gantt and Schedu…10
- CVE-2026-41554Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-41555Unauthenticated SQL Injection in Newsletter Subscription For…9.3
Are you affected by CVE-2026-41545?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST