CVE-2026-67246: data master from 4.1.0.rhu2 (inclusive), through 4.3.3.run1 (inclusive), from 5.0.0.ra82 (inclusive), before…

Affected technology

data master · from 4.1.0.rhu2 (inclusive), through 4.3.3.run1 (inclusive)
asustor

data master · from 5.0.0.ra82 (inclusive), before 5.1.4.rjv2 (exclusive)
asustor

ADM · 5.0.0 through 5.1.3.RI81, 4.1.0 through 4.3.3.RUN1
ASUSTOR Inc.

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as high; integrity and availability impact as none.