HTTP Header Injection Vulnerability in ADM by Asustor

CVE-2026-105324

What is CVE-2026-105324?

The ADM product by Asustor is susceptible to an HTTP header injection vulnerability found in start-page-loader.cgi. This flaw enables an unauthenticated remote attacker to exploit the system by sending crafted HTTP requests that utilize injected headers via the state parameter. Such exploitation allows attackers to leverage the web server’s X-Sendfile mechanism, potentially leading to unauthorized access and retrieval of sensitive files from the host system without requiring any form of authentication. Users of affected versions are advised to apply the necessary security updates to mitigate this risk.

References