External risk intelligence

QuMagie SQL Injection Vulnerability Executes Unauthorized Code

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2025-52425

QuMagie is a photo management application commonly hosted on QNAP NAS devices, which are frequently configured to be internet-facing to allow remote access to media and files. As a web-based application reachable over a network, it fits the pattern of an edge service or remotely accessible web portal, making public internet exposure a common deployment scenario.

SQL Injection

Qnap Qumagie

2.6.0 to before 2.7.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in QuMagie, a photo management application. This issue allows remote attackers to execute unauthorized code or commands, posing a significant security risk. The main concern is confirming relevance and exposure within our environment.

This is a critical code execution flaw.
It impacts remote access and data integrity.
Confirm relevance and exposure; prioritize mitigation.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL queries to the affected application over the network. This could allow them to execute arbitrary code or commands on the system, potentially leading to unauthorized access or control.

Accessible over the network.
Malicious SQL input.
Unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

An SQL injection vulnerability in QuMagie could allow remote attackers to execute unauthorized code or commands when supported by the advisory.

System or user data could be affected.
Unauthorized code execution may occur.
Sensitive information exposure is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects QuMagie, a photo management application typically deployed on QNAP NAS devices, which are often internet-facing for remote access. The initial step for responding teams is to locate all instances of QuMagie, assess their external reachability and business criticality, identify the accountable owner, and then develop a targeted remediation plan.

Application owners should manage the issue.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is QuMagie?

QuMagie is a photo management application developed by QNAP. It is commonly installed on QNAP network-attached storage (NAS) devices to help users organize, search, and share their digital media collections through a web-based interface.

How does CVE-2025-52425 work?

This vulnerability is an SQL injection, classified as CWE-89. It occurs when an application fails to properly sanitize user-supplied data before including it in database queries. By sending crafted inputs, an attacker can manipulate these queries to execute unauthorized code or commands on the underlying system.

Do I need to be authenticated to trigger this flaw?

No, this vulnerability does not require authentication. An attacker can reach the affected application over the network without needing valid user credentials. However, simply using the software for its intended purpose, such as browsing your own photo gallery, does not trigger this issue.

Is my QuMagie instance at risk if it is not internet-facing?

According to Halo Surface Signal, QuMagie is frequently hosted on NAS devices configured for remote access, making them common targets. If your instance is strictly internal and has no exposure to the public internet, the immediate attack surface is significantly lower compared to devices reachable from anywhere.

When should I update my software?

Because this is a critical vulnerability that allows for remote code execution, you should prioritize updates as soon as possible. Your first step is to locate all instances of QuMagie in your environment, verify their connectivity, and upgrade to version 2.7.0 or later to apply the fix.

References

www.qnap.com/en/security-advisory/qsa-25-33

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.