CVE-2026-67247

Analyzed Analyzed - Analysis Complete

Path Traversal in ASUSTOR ADM IHM Log Handling

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: ASUSTOR, Inc.

Description

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause the affected component to access an unintended filesystem path or log database file. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67247

EUVD

EUVD-2026-50964

Affected Vendors & Products

Vendor	Product	Version / Range
asustor	data_master	From 4.1.0.rhu2 (inc) to 4.3.3.run1 (inc)
asustor	data_master	From 5.0.0.ra82 (inc) to 5.1.4.rjv2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in ASUSTOR's ADM software where user-controlled disk serial input is not properly validated before being used to construct a file path for IHM log database access. An authenticated attacker could exploit this to access unintended filesystem paths or log files.

Detection Guidance

To detect this vulnerability, check for unauthorized access to filesystem paths or log database files in ADM versions 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81. Review IHM log handling for unexpected path traversal attempts in user-controlled disk serial input. Inspect VPN certificate upload paths for improper file writes outside intended directories.

Impact Analysis

An authenticated attacker could access sensitive files outside intended directories, potentially reading or modifying log data or other system files depending on their privileges. This could lead to information disclosure or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information if such data is stored on the affected system.

Mitigation Strategies

Immediately update ADM to the latest patched version if available. If no patch exists, restrict authenticated user access to the IHM Log handling component and monitor filesystem paths accessed by ADM processes for unusual activity.

Hi! I’m here to help you understand CVE-2026-67247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70