CVE-2026-3179: Asustor Data Master Path Traversal Flaw

CVE-2026-3179 Overview

CVE-2026-3179 is a critical path traversal vulnerability affecting the FTP Backup functionality in ASUSTOR Data Master (ADM). The vulnerability stems from improper sanitization of filenames received from the FTP server when parsing directory listings. A malicious FTP server or a man-in-the-middle (MITM) attacker can craft filenames containing path traversal sequences, causing the ADM client to write files outside the intended backup directory.

This vulnerability can allow an attacker to overwrite arbitrary files on the system, potentially leading to privilege escalation or remote code execution on affected ASUSTOR NAS devices.

Critical Impact

Successful exploitation allows attackers to overwrite arbitrary system files, potentially achieving remote code execution or privilege escalation on ASUSTOR NAS devices.

Affected Products

• ASUSTOR Data Master (ADM) versions 4.1.0 through 4.3.3.ROF1
• ASUSTOR Data Master (ADM) versions 5.0.0 through 5.1.2.RE51

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-3179 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-3179

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The FTP Backup feature in ADM processes directory listings received from remote FTP servers without adequately sanitizing the filenames contained within those listings.

When the ADM client parses directory listings from an FTP server, it fails to properly validate filenames for malicious path traversal sequences such as ../ or ..\\. An attacker controlling a malicious FTP server, or positioned as a MITM between the ADM client and a legitimate FTP server, can inject specially crafted filenames that cause files to be written outside the intended backup directory.

The network-accessible nature of this vulnerability combined with the ability to achieve arbitrary file write makes this particularly dangerous in environments where ASUSTOR NAS devices are configured to perform FTP backups to external servers.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and sanitization when processing filenames from FTP directory listings. The FTP Backup implementation trusts the filenames provided by the remote server without validating that the resulting write path remains within the designated backup directory. This allows path traversal sequences to escape the intended directory structure and write to arbitrary locations on the filesystem.

Attack Vector

The attack vector for CVE-2026-3179 is network-based. An attacker can exploit this vulnerability through two primary methods:

1. Malicious FTP Server: An attacker sets up a malicious FTP server that responds to directory listing requests with filenames containing path traversal sequences (e.g., ../../../etc/shadow). When a victim configures their ADM device to backup from this server, the malicious filenames cause files to be written outside the backup directory.

2. Man-in-the-Middle Attack: An attacker positioned between the ADM device and a legitimate FTP server can intercept and modify directory listing responses to inject path traversal sequences into filenames.

When the ADM FTP Backup client receives a directory listing containing a filename like ../../../etc/cron.d/malicious, it fails to sanitize the path, allowing the attacker to write files to sensitive system locations. This can be leveraged to achieve remote code execution by overwriting configuration files, scheduled tasks, or other system components.

Detection Methods for CVE-2026-3179

Indicators of Compromise

• Unexpected files appearing in system directories outside of FTP backup locations
• Modified system configuration files that correlate with FTP backup operation times
• Suspicious entries in FTP backup logs showing unusual filenames with ../ sequences
• Unauthorized cron jobs or scheduled tasks appearing after FTP backup operations

Detection Strategies

• Monitor FTP backup logs for filenames containing path traversal patterns such as ../ or ..\\
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Review ADM system logs for anomalous file write operations during FTP backup activities
• Deploy network traffic analysis to inspect FTP directory listing responses for malicious filename patterns

Monitoring Recommendations

• Enable verbose logging for FTP Backup operations in ADM to capture detailed file operation records
• Configure alerts for file modifications in critical system directories such as /etc/, /usr/, and /var/
• Monitor outbound FTP connections from ADM devices to identify connections to untrusted or suspicious servers
• Implement network segmentation to limit exposure of NAS devices to potentially malicious FTP servers

How to Mitigate CVE-2026-3179

Immediate Actions Required

• Update ASUSTOR Data Master to a patched version as soon as available from ASUSTOR
• Temporarily disable FTP Backup functionality until patches can be applied
• Review and audit existing FTP backup configurations to ensure connections are only made to trusted servers
• Implement network controls to restrict FTP traffic from ADM devices to known, trusted destinations only

Patch Information

ASUSTOR has released a security advisory addressing this vulnerability. Users should consult the ASUSTOR Security Advisory #53 for detailed patch information and updated firmware versions. Apply the recommended updates to ADM versions 4.x and 5.x as specified in the advisory.

Workarounds

• Disable the FTP Backup feature entirely until a patch is applied
• If FTP backups are required, ensure connections are only made to fully trusted and controlled FTP servers
• Use SFTP or other secure backup methods instead of FTP where possible
• Implement network-level filtering to block path traversal sequences in FTP traffic if supported by network security infrastructure

# Verify current ADM version and check for available updates
# Access ADM web interface: Settings > ADM Update
# Or via SSH:
cat /etc/nas.conf | grep version

# Disable FTP Backup temporarily via ADM interface:
# Backup & Restore > FTP Backup > Disable all backup jobs