CVE-2026-67246

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.asustor.com/security/security_advisory_detail?id=68	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:asustor:data_master::::::::
	cpe:2.3:o:asustor:data_master::::::::

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta fue encontrada en el componente Wallpaper de ADM. La vulnerabilidad ocurre porque la entrada de ruta de fondo de pantalla controlada por el usuario no se valida suficientemente antes de ser utilizada para el acceso a archivos. Un atacante autenticado puede explotar este problema para acceder o manipular archivos fuera del directorio de fondo de pantalla previsto, sujeto a los permisos de usuario y las restricciones del sistema de archivos. Los productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.RUN1, así como desde ADM 5.0.0 hasta ADM 5.1.3.RI81.

Information

Published : 2026-07-30 05:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67246

Mitre link : CVE-2026-67246

CVE.ORG link : CVE-2026-67246

JSON object : View

Products Affected

asustor

data_master

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-67246", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67246", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T13:27:52.358918Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@asustor.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@asustor.com", "affectedData": [{"vendor": "ASUSTOR Inc.", "product": "ADM", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.1.3.RI81"}, {"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.3.3.RUN1"}], "platforms": ["Linux", "x86", "ARM", "64 bit"], "packageName": "Wallpaper", "defaultStatus": "unaffected"}]}], "published": "2026-07-30T05:16:38.877", "references": [{"url": "https://www.asustor.com/security/security_advisory_detail?id=68", "tags": ["Vendor Advisory"], "source": "security@asustor.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@asustor.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta fue encontrada en el componente Wallpaper de ADM. La vulnerabilidad ocurre porque la entrada de ruta de fondo de pantalla controlada por el usuario no se valida suficientemente antes de ser utilizada para el acceso a archivos. Un atacante autenticado puede explotar este problema para acceder o manipular archivos fuera del directorio de fondo de pantalla previsto, sujeto a los permisos de usuario y las restricciones del sistema de archivos.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.RUN1, as\u00ed como desde ADM 5.0.0 hasta ADM 5.1.3.RI81."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8B93EE0-5A71-4537-A116-D3A024BFD988", "versionEndIncluding": "4.3.3.run1", "versionStartIncluding": "4.1.0.rhu2"}, {"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F80E3A8-B1E6-4AD0-95B4-20B47991E8EF", "versionEndExcluding": "5.1.4.rjv2", "versionStartIncluding": "5.0.0.ra82"}], "operator": "OR"}]}], "sourceIdentifier": "security@asustor.com"}