Vulnerability · Published Feb 25, 2026 · Assigned by ASUSTOR1

CVE-2026-3179A path traversal vulnerability was found in the FTP Backup on the ADM.

Critical 9.2

In plain English

A critical-severity path traversal in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path traversal vulnerability may allow an attacker to overwrite arbitrary files on the system and potentially achieve privilege escalation or remote code execution. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1.0 – through 4.3.3.ROF15.0.0 – through 5.1.2.RE51

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.asustor.com/security/security_advisory_detail?id=53 vendor-advisory