Path Traversal Vulnerability in ADM Wallpaper Component by Asustor
CVE-2026-67246

6.9MEDIUM

Key Information:

Vendor

Asustor Inc.

Status
Adm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67246?

A path traversal vulnerability exists in the Wallpaper component of Asustor's ADM, allowing an authenticated attacker to manipulate user-controlled wallpaper path inputs. This flaw makes it possible to access files outside of the designated wallpaper directory, depending on user permissions and filesystem restrictions. Users of ADM versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81 are particularly at risk.

Affected Version(s)

ADM Linux 5.0.0 <= 5.1.3.RI81

ADM Linux 4.1.0 <= 4.3.3.RUN1

References

https://www.asustor.com/security/security_advisory_detail...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.