Access Control Flaw in EZ Sync Manager by Asustor

CVE-2025-7699

What is CVE-2025-7699?

An access control issue was identified in the EZ Sync Manager of Asustor's ADM, which permits authenticated users to copy arbitrary files from the server's file system into their EZSync folders. This flaw arises from inadequate authorization checks on the file parameter in HTTP requests, enabling attackers to access files beyond their authorized boundaries if those files have read permissions set for other users at the operating system level. This can lead to unauthorized exposure of sensitive information, representing a significant security risk to users.

References