CVE-2026-67246

Analyzed Analyzed - Analysis Complete

Path Traversal in ASUSTOR ADM Wallpaper Component

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: ASUSTOR, Inc.

Description

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67246

EUVD

EUVD-2026-50963

Affected Vendors & Products

Vendor	Product	Version / Range
asustor	data_master	From 4.1.0.rhu2 (inc) to 4.3.3.run1 (inc)
asustor	data_master	From 5.0.0.ra82 (inc) to 5.1.4.rjv2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in ASUSTOR's ADM software, specifically in the Wallpaper component. It occurs because user-controlled input for wallpaper paths is not properly validated before being used to access files. An authenticated attacker could exploit this to access or modify files outside the intended wallpaper directory, depending on user permissions and filesystem restrictions.

Detection Guidance

This vulnerability can be detected by checking for unauthorized file access or manipulation in the Wallpaper component of ADM. Review system logs for suspicious file operations in directories outside the intended wallpaper storage paths. Check for unexpected file writes or reads in parent directories of the wallpaper storage location.

Impact Analysis

If you use ASUSTOR devices with ADM versions 4.1.0 through 4.3.3.RUN1 or 5.0.0 through 5.1.3.RI81, an attacker with access could read or alter files outside the wallpaper directory. This might lead to unauthorized data access, system configuration changes, or other malicious activities limited by user permissions.

Compliance Impact

This vulnerability could potentially violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to sensitive data. If exploited, it may result in data breaches, unauthorized modifications, or exposure of protected information, depending on the files accessed.

Mitigation Strategies

Update ADM to the latest version if a patch is available. If no patch exists, restrict access to the Wallpaper component and monitor for unauthorized file access attempts. Disable unnecessary user permissions for the affected component.

Hi! I’m here to help you understand CVE-2026-67246. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70