---
id: CVE-2025-62857
title: A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie
summary: >-
  A cross-site scripting (XSS) vulnerability has been reported to affect
  QuMagie. The remote attackers can then exploit the vulnerability to bypass
  security mechanisms or read application data.


  We have already fixed the vulnerability in t…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: qnap
product: qumagie
affected:
  - 'qumagie >= 2.0.0, < 2.8.1'
patched:
  - qumagie 2.8.1
published: '2026-01-02'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62857'
references:
  - url: 'https://www.qnap.com/en/security-advisory/qsa-25-49'
    label: security@qnapsecurity.com.tw
tags:
  - nvd
epss: 0.00223
epssPercentile: 0.11935
ingestedAt: '2026-10-14T13:30:58.477Z'
---

## Overview

A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version:
QuMagie 2.8.1 and later

## Affected

- `qumagie >= 2.0.0, < 2.8.1`

## Remediation

Upgrade past the affected range:

- `qumagie 2.8.1`