CVE-2026-67247 is a path traversal vulnerability (CWE-22) in ASUSTOR Inc.'s ADM product affecting the IHM Log handling functionality. The vulnerability is due to inadequate validation of user-controlled disk serial input before it is used to construct the path to an IHM log database file. This flaw allows an authenticated attacker to cause the affected component to access unintended filesystem locations or log database files. The vulnerability affects ADM versions from 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81. The CVSS 4.0 base score is 7.1, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An authenticated attacker can exploit this vulnerability to access unintended filesystem paths or log database files by manipulating the disk serial input used in path construction. This could lead to unauthorized access to sensitive files or data within the affected system. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk of exploitation. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to limit access to the vulnerable functionality and monitor for suspicious activity related to IHM log handling. Avoid relying on user-controlled input for filesystem path construction where possible.