The Wallpaper component of ADM accepts a user‑controlled wallpaper path without proper validation, allowing a path traversal attack. An authenticated user can supply a crafted path to read or write files outside the intended wallpaper directory. This can lead to disclosure of confidential data, modification of system files, or other unintended data exposure, depending on the permissions of the authenticated account. The weakness is classified as CWE‑22.

ASUSTOR Inc. Administrative Desktop Manager (ADM) versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81 are affected. The flaw exists in the Wallpaper handling portion of the ADM service.

The CVSS score of 6.9 indicates a moderate‑to‑high impact risk. The EPSS score of less than 1% suggests that exploitation probability is currently low, and the issue is not listed in the CISA KEV catalog. Because the vulnerability requires authentication, an attacker must first obtain valid ADM credentials. Once authenticated, they can craft a path traversal payload in the wallpaper path field, causing the system to treat it as a file reference outside the confined directory, potentially gaining read/write access to files within the scope of their user permissions.