EUVD-2026-50963
GHSA-j5cp-rjh5-gm88
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires admin-level authentication to ADM web interface (PR:H); path traversal enables file read only, so I:N and A:N; scope unchanged as impact stays within the ADM system.
Primary rating from Vendor (ASUSTOR1).
CVSS VectorVendor: ASUSTOR1
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
AnalysisAI
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-privileged attackers across two separate version branches. Affected NAS appliances running ADM 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 allow an attacker who controls an admin-level account to submit crafted wallpaper path inputs containing traversal sequences, escaping the intended directory and reading files restricted only by the underlying OS user permissions. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the realistic attacker population.
Technical ContextAI
ASUSTOR ADM is the web-based management operating system for ASUSTOR NAS appliances, identified by CPE cpe:2.3:a:asustor_inc.:adm:*:*:*:*:*:*:*:*. CWE-22 (Path Traversal) arises when user-supplied input - here, a wallpaper file path - is incorporated into a filesystem operation without adequate canonicalization or boundary enforcement. Classic exploitation leverages sequences such as '../../../' to escape the application's intended working directory. The vulnerability is isolated to the Wallpaper UI component, suggesting the sanitization gap is localized rather than systemic, though any web-accessible component that constructs filesystem paths from user input in ADM warrants scrutiny. The CVSS 4.0 vector confirms the attack is network-delivered (AV:N), trivially repeatable (AC:L, AT:N), and produces high confidentiality impact (VC:H) with no integrity or availability consequence.
RemediationAI
The primary remediation is to upgrade ADM beyond the affected version ranges (4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) to a patched release confirmed by ASUSTOR. The vendor advisory at https://www.asustor.com/security/security_advisory_detail?id=68 should be consulted for exact target versions, as no specific fix version is identified in the available intelligence. As a compensating control while patching is coordinated, restrict access to the ADM web management interface to trusted internal networks or VPN only - this raises the bar for remote exploitation by limiting who can reach the authenticated session. Additionally, auditing and rotating ADM administrator credentials reduces risk from pre-compromised accounts. Note that restricting network access to the management interface does not eliminate the vulnerability for insider-threat scenarios and should be treated as a temporary measure only.
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory st
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size vali
Remote code execution in ASUSTOR ADM (ASUSTOR Data Master) operating system versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.RE
A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validati
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating
Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attacke
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenti
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, hi
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. Rated medium severity (CVSS 6
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today