# CVE-2026-67246: ASUSTOR ADM path traversal in Wallpaper component

Source: https://junglewise.ai/threats/cve-2026-67246-asustor-adm-path-traversal-in-wallpaper-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67246 · Severity: info · CVSS 6.9 · Published 2026-07-30

ASUSTOR ADM is the operating system used to manage ASUSTOR Network Attached Storage (NAS) devices. A security flaw in the wallpaper management component allows an authorized user to bypass folder restrictions. This could lead to the unauthorized viewing or manipulation of sensitive system files, potentially compromising the privacy and integrity of data stored on the NAS.

Technologies: [ASUSTOR ADM](https://junglewise.ai/threats/technologies/adm). Vendors: [ASUSTOR](https://junglewise.ai/threats/vendors/asustor).

## Quick answers

**Is CVE-2026-67246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67246 being exploited in the wild.

**How severe is CVE-2026-67246?** Informational severity, with a CVSS score of 6.9, published 30 July 2026.

**Which products and versions are affected?** ASUSTOR ADM 4.1.0 - 4.3.3.RUN1, 5.0.0 - 5.1.3.RI81.

**Is there a fix for CVE-2026-67246?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67246 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-67246?** Check whether you run ASUSTOR ADM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Wallpaper component of ASUSTOR ADM due to insufficient validation of user-supplied path input. An authenticated attacker with high privileges can provide specially crafted paths (e.g., using dot-dot-slash sequences) to access or modify files on the underlying filesystem that are outside the designated wallpaper directory. The exploit is subject to the permissions of the user account and general filesystem restrictions. The vulnerability affects ADM versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81.

## Affected products

- ASUSTOR ADM 4.1.0 - 4.3.3.RUN1, 5.0.0 - 5.1.3.RI81

## Timeline

- 2026-07-30: advisory: ASUSTOR published security advisory AS-2026-019
- 2026-07-30: disclosed: CVE-2026-67246 published to NVD

## References

- [https://www.asustor.com/security/security_advisory_detail?id=68](https://www.asustor.com/security/security_advisory_detail?id=68)

## Related threats

- [ASUSTOR ADM HTTP header injection in start-page-loader.cgi](https://junglewise.ai/threats/cve-2026-105324-an-http-header-injection-vulnerability-in-start-page-loader-cgi)
- [ASUSTOR ADM stack buffer overflow in File Explorer](https://junglewise.ai/threats/cve-2026-67248-asustor-adm-stack-buffer-overflow-in-file-explorer)
- [ASUSTOR ADM path traversal in IHM Log handling](https://junglewise.ai/threats/cve-2026-67247-asustor-adm-path-traversal-in-ihm-log-handling)
- [ASUSTOR ADM path traversal in VPN Clients](https://junglewise.ai/threats/cve-2026-67245-asustor-adm-path-traversal-in-vpn-clients)
- [ASUSTOR ADM format string vulnerability in Notification OAuth settings](https://junglewise.ai/threats/cve-2026-67244-asustor-adm-format-string-vulnerability-in-notification-oauth)