A path traversal flaw exists in the IHM Log handling component of ASUSTOR’s ADM when it does not properly validate user‑controlled disk serial input before constructing the log database path. An attacker who can authenticate to the ADM interface can exploit this to read arbitrary files on the device’s filesystem, leading to information disclosure. The weakness is a classic directory traversal (CWE‑22).

ASUSTOR Inc. ADM versions from 4.1.0 through 4.3.3.RUN1 and from 5.0.0 through 5.1.3.RI81 are affected. All installations of these releases are vulnerable until patched or upgraded beyond the listed versions.

The CVSS score of 7.1 rates it as a high‑severity vulnerability. However, the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. The attack is likely to occur through an authenticated web interface or API; a local or network attacker who can log in to ADM can trigger the path traversal. The risk lies mainly in the potential for confidential data exposure.