This vulnerability arises from improper limitation of a pathname to a restricted directory (CWE-22) in the Wallpaper component of ASUSTOR ADM. User-supplied wallpaper path inputs are not adequately validated before file access, enabling an authenticated attacker with high privileges to perform path traversal attacks. This can lead to unauthorized access or manipulation of files outside the wallpaper directory, constrained by user permissions and filesystem restrictions. Affected versions include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. No vendor advisory or patch information is currently available.

An authenticated attacker with high privileges can exploit this vulnerability to access or modify files outside the intended wallpaper directory. The impact is limited by the attacker's permissions and filesystem restrictions. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the attacker's existing rights. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Wallpaper component to trusted users only and monitor for suspicious activity related to file access. Avoid granting unnecessary high privileges to users who can interact with the wallpaper functionality.