A path traversal weakness in the FTP Backup feature of ASUSTOR ADM occurs because filenames from an FTP server are not properly sanitized when parsing directory listings. The flaw, CWE‑22, can allow a malicious or compromised FTP server to supply crafted file names that cause the ADM client to write files outside the intended backup directory. An attacker could overwrite arbitrary files on the system, potentially gaining elevated privileges or executing code remotely, depending on the overwritten files and system configuration.

ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.2.RE51 are vulnerable to the path traversal issue in the FTP Backup component.

The vulnerability has a CVSS score of 9.2, classifying it as critical, but the EPSS score is less than 1%, indicating that exploitation attempts are currently rare. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote or MITM FTP server that sends malicious filenames; the attacker would need network access to the ADM's FTP service or the ability to MITM the connection. Successful exploitation would allow file overwrite, which could lead to privilege escalation or remote code execution if sensitive files are targeted.