PT-2026-21879 · Asustor · Asustor Adm

Nuke · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-3179

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 ASUSTOR ADM versions 5.0.0 through 5.1.2.RE51

Description A path traversal issue exists in the FTP Backup feature of ASUSTOR ADM. The software does not adequately sanitize filenames received from an FTP server when processing directory listings. This allows a malicious server or a man-in-the-middle attacker to create filenames with path traversal sequences, potentially enabling them to write files outside the intended backup directory. Successful exploitation of this issue could lead to arbitrary file overwrites, privilege escalation, or remote code execution.

Recommendations Update ASUSTOR ADM to a version later than 5.1.2.RE51. Update ASUSTOR ADM to a version later than 4.3.3.ROF1.

Fix

LPE

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3179

Affected Products

Asustor Adm

References · 12

• https://asustor.com/security/security_advisory_detail?id=53 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3179 · Security Note
• https://twitter.com/VulmonFeeds/status/2026673492125430267 · Twitter Post
• https://t.me/CVEtracker/45705 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2026573154232012996 · Twitter Post
• https://twitter.com/CveFindCom/status/2026548035526832416 · Twitter Post
• https://twitter.com/cracbot/status/2028425232894288175 · Twitter Post
• https://t.me/cveNotify/153115 · Telegram Post
• https://twitter.com/CVEnew/status/2026641333784342955 · Twitter Post
• https://t.me/cveNotify/153336 · Telegram Post
• https://twitter.com/TheHackerWire/status/2027068705746964645 · Twitter Post