CVE-2018-15694: Asustor Data Master

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled.

Affected products

• Asustor Data Master: up to and including 3.1.5

Published 2018-08-27. Last modified 2026-06-17.