CVE-2026-3179: A path traversal vulnerability was found in the FTP Backup on the ADM.
The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path traversal vulnerability may allow an attacker to overwrite arbitrary files on the system and potentially achieve privilege escalation or remote code execution. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3179?
CVE-2026-3179 is classified as a high-severity path traversal vulnerability.
How do I fix CVE-2026-3179?
To fix CVE-2026-3179, update your ASUSTOR ADM software to the latest version beyond 4.3.3.ROF1 or 5.0.0.
Which versions of ASUSTOR ADM are affected by CVE-2026-3179?
CVE-2026-3179 affects ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.2.RE51.
What types of systems are impacted by CVE-2026-3179?
The impacted systems include those running ASUSTOR ADM on Linux, x86, ARM, and 64-bit architectures.
What kind of vulnerability is CVE-2026-3179?
CVE-2026-3179 is a path traversal vulnerability that allows attackers to access restricted directories.