CVE-2023-47560 is an OS command injection flaw in QNAP's QuMagie. NVD scores it 7.4, High. The fix is QuMagie 2.2.1 and later. QuMagie is the photo app for QNAP NAS devices. The attacker needs a valid account, and the update is a normal App Center install. Check each NAS you run and update it.
What's affected
The record names QuMagie 2.2.0 in its product list, and QNAP's text says the fix is QuMagie 2.2.1 and later. QuMagie is the photo management app for QNAP NAS devices.
The weaknesses listed in the record: CWE-77, CWE-78.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update QuMagie to 2.2.1 or later through the App Center.
- Check the version on every NAS that runs the app, including units at remote sites.
- Review the user accounts on each NAS, and remove or disable those no longer needed.
- Do not expose the NAS management or app ports directly to the internet. Use a VPN.
- Add each NAS to your asset inventory so future QNAP advisories reach someone.
Why it matters
OS command injection, CWE-78, means an application builds a system command from input it did not clean, so input can change what the command does. CWE-77 is the broader class, improper neutralization of special elements used in a command.
The record says authenticated users could execute commands over the network. The scope in the vector is Changed (S:C), which means the effect can extend beyond the app to the wider system. The impact on confidentiality, integrity and availability is rated Low each, so NVD lands at 7.4. That is a case where the vector shape matters: the individual impact scores are modest, but the scope change lifts the total.
A NAS holds backups, photos and shared files for a whole team, so a flaw in one app is worth closing quickly. The condition to remember is that the attacker needs a valid account. Weak or shared passwords on the NAS make that condition easier to meet.
Quick check
Does the attacker need to be signed in?
Yes. QNAP says authenticated users could exploit it.
Is CVE-2023-47560 exploited in the wild?
The record's CISA KEV flag is false, and the text I read does not report exploitation.
Sources
Last reviewed: 19 October 2026.
