We use cookies to help us improve our webpage. Please read our Cookie Policy .
ASUSTOR Product Security Advisory

AS-2026-022: ADM

2026-10-07

Severity

Important

Status

Resolved

Statement

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication.

Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.

  • The issues have been fixed on ADM 5.1.4.RM62 and ADM 4.3.3.RY62.

Affected Products

Product Severity Fixed Release Availability
ADM 5.0 and 5.1 Important Upgrade to ADM 5.1.4.RM62 or above.
ADM 4.3, 4.2 and 4.1 Important Upgrade to ADM 4.3.3.RY62 or above.

Detail

  • CVE-2026-105324
    • Severity: Critical
    • CVSS4 Base Score: 9.2
    • CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    • An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.

Reference

Acknowledgement

Benjamin Harris of watchTowr


Revision

Revision Date Description
1 2026-10-06 Initial public release.
2 2026-10-07 CVE ID (CVE-2026-105324) is assigned for the issues.
3 2026-10-07 ADM 5.1.4.RM62 and ADM 4.3.3.RY62 have been released for fixing the issues.