CVE-2026-67246 Overview
CVE-2026-67246 is a path traversal vulnerability [CWE-22] in the Wallpaper component of Asustor Data Master (ADM). The wallpaper path input accepted from users is not sufficiently validated before being used for file access. An authenticated attacker can leverage this weakness to read or manipulate files outside the intended wallpaper directory. The scope of access depends on the acting user's permissions and filesystem restrictions.
Affected versions span ADM 4.1.0 through ADM 4.3.3.RUN1 and ADM 5.0.0 through ADM 5.1.3.RI81. The vulnerability requires high privileges and can be exploited over the network without user interaction.
Critical Impact
An authenticated attacker with elevated privileges can traverse the filesystem via the Wallpaper component and access files outside the wallpaper directory, exposing confidential data on the NAS device.
Affected Products
- Asustor ADM 4.1.0 through 4.3.3.RUN1
- Asustor ADM 5.0.0 through 5.1.3.RI81
- Wallpaper component of ADM
Discovery Timeline
- 2026-07-30 - CVE-2026-67246 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-67246
Vulnerability Analysis
The Wallpaper component in ADM accepts a user-controlled path parameter that identifies the wallpaper file to load. The component uses this parameter directly in filesystem operations without normalizing or constraining the resolved path to the designated wallpaper directory. As a result, sequences such as ../ inside the parameter cause the file access routine to resolve outside the intended directory.
An authenticated attacker with sufficient privileges can submit a crafted path to access arbitrary files on the NAS. The impact is bounded by the operating system permissions of the account performing the request. Successful exploitation results in disclosure of file contents that reside outside the wallpaper storage location.
Root Cause
The root cause is missing canonicalization and directory containment checks on the wallpaper path input. Input validation is limited to expectations about file naming rather than enforcing that the resolved absolute path stays within the wallpaper directory. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation is performed over the network against the ADM web interface. The attacker must first authenticate to ADM with an account that has high privileges. Once authenticated, the attacker submits a wallpaper path parameter containing traversal sequences to reference files outside the wallpaper directory. No user interaction is required from other operators of the NAS.
The vulnerability is described in prose only. See the Asustor Security Advisory #68 for vendor-specific technical details.
Detection Methods for CVE-2026-67246
Indicators of Compromise
- Web request parameters targeting the Wallpaper component containing traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f.
- Unexpected authenticated sessions accessing wallpaper-related endpoints followed by file reads outside the wallpaper directory.
- ADM access logs showing wallpaper API calls that reference absolute paths or paths ending in sensitive filenames such as passwd, shadow, or configuration files.
Detection Strategies
- Inspect ADM HTTP access logs for wallpaper endpoints and flag requests where the path parameter contains directory traversal characters or references files outside the expected wallpaper directory.
- Correlate authenticated NAS sessions with anomalous file read patterns to identify privilege abuse via the Wallpaper component.
- Deploy web application filtering rules that normalize request paths and reject traversal patterns before they reach the ADM application.
Monitoring Recommendations
- Enable verbose logging on the ADM web interface and forward logs to a centralized SIEM for retention and analysis.
- Monitor authenticated administrative accounts for unexpected activity on the Wallpaper component.
- Track filesystem access on the NAS for reads of sensitive files by the ADM web process outside normal operating patterns.
How to Mitigate CVE-2026-67246
Immediate Actions Required
- Upgrade ADM to a fixed release that is newer than ADM 4.3.3.RUN1 in the 4.x branch or newer than ADM 5.1.3.RI81 in the 5.x branch, following the vendor advisory.
- Restrict administrative access to ADM to trusted networks and trusted operators until the update is applied.
- Rotate credentials for any high-privilege ADM accounts that may have been used on unpatched systems.
Patch Information
Asustor has published guidance for this issue in Asustor Security Advisory #68. Administrators should consult the advisory for the exact fixed build numbers and apply the update through the ADM update mechanism. Confirm the running ADM version after the update to validate that the patched build is active.
Workarounds
- Limit ADM administrative privileges to the minimum number of accounts required, since exploitation requires high privileges.
- Place the NAS management interface behind a VPN or restrict access using firewall rules to reduce network exposure.
- Audit existing ADM accounts and remove or disable unused high-privilege accounts to shrink the attack surface.
Refer to the Asustor Security Advisory #68 for vendor-recommended configuration steps.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
