Path Traversal Vulnerability in ADM Log Handling by Asustor
CVE-2026-67247

7.1HIGH

Key Information:

Vendor

Asustor Inc.

Status
Adm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67247?

A path traversal vulnerability exists in the IHM Log handling of Asustor's ADM software. This issue arises from insufficient validation of user-controlled disk serial input, which allows an authenticated attacker to manipulate the construction of the file path for the IHM log database. By exploiting this vulnerability, the attacker could gain access to unintended filesystem paths or log database files, potentially leading to unauthorized data exposure or manipulation.

Affected Version(s)

ADM Linux 5.0.0 <= 5.1.3.RI81

ADM Linux 4.1.0 <= 4.3.3.RUN1

References

https://www.asustor.com/security/security_advisory_detail...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.