CVE-2023-47219 is a low severity SQL injection in QNAP QuMagie 2.2.0, scored 3.5, that authenticated users can trigger over a network. QNAP fixed it in QuMagie 2.2.1. Update the app through the App Center, and review which users have accounts on your NAS.
What's affected
The record names QNAP QuMagie 2.2.0 and quotes QNAP's wording: a SQL injection vulnerability has been reported to affect QuMagie, and if exploited it could allow authenticated users to inject malicious code via a network. QNAP says it has fixed the issue in QuMagie 2.2.1 and later.
The record's product list names only 2.2.0, so I do not know whether earlier releases were checked. If you run an older QuMagie, update anyway, as the safe course is to move to the current release.
I could not read QNAP's advisory page, QSA-23-32, from my fetch, so this post relies on the record's quote of it.
The score is low, 3.5, because the attacker needs a valid account and the flaw needs user interaction. It was published to NVD on 5 January 2024.
The NVD record was published on 2024-01-05, scores 3.5 (Low), and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. Weakness class: CWE-89.
How to check if you're exposed
Find the QuMagie version on each QNAP NAS.
- Sign in to QTS or QuTS hero as an administrator.
- Open the App Center and find QuMagie in the list of installed apps.
- Read the version number and compare with 2.2.1.
Also list user accounts on the NAS with access to QuMagie, since the flaw needs a signed-in user. Remove accounts that are old or shared.
What to do now
- Open the App Center on each NAS and update QuMagie to 2.2.1 or later.
- Remove unused accounts and avoid shared logins on the NAS.
- Keep the NAS off the internet where you can, or place it behind a VPN.
- Make sure the NAS firmware is also up to date, since apps depend on the platform.
- Check QNAP's advisory for further notes.
Why it matters
SQL injection, CWE-89, mixes data and query text. A value from a request becomes part of a database query without proper separation, so a user can change what the query does. The standard cure is a parameterized query.
The rating is low because an attacker needs credentials and a click. On a home or small office NAS with many family members or staff sharing accounts, the number of people who count as authenticated can be larger than you think. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Low scores are still worth closing when the fix is a routine update. Apps on a NAS are easy to forget, since they update separately from the firmware.
Quick check
Do I need a login to exploit this?
Yes. QNAP's wording and the vector both say authenticated users, and the score is low for that reason.
Sources
Last reviewed: 19 October 2026.
