CVE-2026-67246 is a CWE-22 path traversal vulnerability in the Wallpaper component of ASUSTOR ADM. The vulnerability arises because the wallpaper path input, controlled by the user, is insufficiently validated before file access. An authenticated attacker can exploit this to access or modify files outside the wallpaper directory, constrained by user privileges and filesystem controls. Affected versions include ADM 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81. No official patch or remediation level has been published as of the data provided.

An authenticated attacker with high privileges can exploit this vulnerability to access or manipulate files outside the intended wallpaper directory. The impact is limited by the attacker's user permissions and filesystem restrictions, potentially leading to unauthorized file disclosure or modification within those constraints. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Wallpaper component to trusted users only and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to users who can access the wallpaper functionality.