Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-105324

An HTTP header injection vulnerability was found in the ADM

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR Inc. ADM

Default version status: unaffected

  • 5.0.0 to ≤ 5.1.4.RL21affected
  • 4.1.0 to ≤ 4.3.3.RWC1affected

References