CVE-2025-52425 is a critical SQL injection (CVSS 9.8) in QNAP QuMagie, the photo app for QNAP NAS devices. QNAP says it fixed the flaw in QuMagie 2.7.0 and later. Update the app from the App Center and check the vendor advisory QSA-25-33 for the full list of affected releases.
What's affected
The CVE record names QNAP QuMagie and gives one fixed line: QuMagie 2.7.0 and later. It does not list the earlier affected versions, so the safe reading is that anything older than 2.7.0 should be treated as exposed until the advisory says otherwise. The record points to QNAP advisory QSA-25-33, which was not retrievable while this post was written, so confirm details there.
The weakness is CWE-89 (SQL injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges, no user interaction and high impact on confidentiality, integrity and availability. The record says a remote attacker could exploit the flaw to execute unauthorized code or commands. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild.
How to check if you're exposed
QuMagie runs as an app on a QNAP NAS, so the check is in the NAS administration interface. Open App Center, find QuMagie in the list of installed apps and read its version number. Anything below 2.7.0 needs an update.
If you manage several devices, record the QuMagie version for each one. Also check whether the NAS or the QuMagie web interface is reachable from the internet, through a port forward, QNAP's own remote access features or a reverse proxy. A NAS that is only reachable on the local network is a smaller target than one that answers on a public address.
The vendor advisory is the reference for exact affected versions and for any extra steps. Read it before you close the ticket.
What to do now
- Open App Center on each QNAP NAS and note the installed QuMagie version.
- Update QuMagie to 2.7.0 or later. If the update is not offered, update QTS or QuTS hero first and check again.
- Read QNAP advisory QSA-25-33 and compare its affected version list with what you run.
- Remove direct internet exposure of the NAS web interface and QuMagie where you can. Use a VPN for remote access.
- Review the NAS access and application logs for unusual requests to QuMagie around the disclosure date and since.
- Take a backup of the data on the NAS before updating, and confirm the backup restores.
Why it matters
SQL injection happens when text sent by a user ends up inside a database command and changes what the command does. A NAS photo service is a rich target for it. The database behind it knows about accounts, shared albums and file paths, and the app runs with access to the stored media.
The score is 9.8 because every part of the vector is bad for defenders: it needs no login, no user action and little skill. When the affected product is a storage device, the damage is not only data exposure. A compromise of the NAS can reach backups and shared folders for the whole organization.
Network storage is also easy to forget. It gets set up once, collects photos and documents for years, and is updated rarely. A short list of NAS devices with their app versions makes events like this a ten minute task instead of a search.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which QuMagie version fixes CVE-2025-52425?
QNAP lists QuMagie 2.7.0 and later as fixed. The record does not name the earlier affected versions, so treat anything older as exposed and check advisory QSA-25-33.
Is it exploited in the wild?
The record does not say so, and the CISA Known Exploited Vulnerabilities flag is false. A critical, unauthenticated flaw on an internet reachable device still deserves a quick update.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52425
- QNAP security advisory QSA-25-33, listed in the CVE record (https://www.qnap.com/en/security-advisory/qsa-25-33). The page did not return content when fetched, so versions beyond the fixed line come from the record only.
Last reviewed: 18 October 2026.
