CVE-2026-105324 in ADM
Summary
by MITRE • 10/07/2026
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the start-page-loader.cgi component of ADM systems represents a critical HTTP header injection flaw that enables unauthenticated remote attackers to bypass access controls and read arbitrary files on the host system. This issue stems from improper validation of user-supplied input within the state parameter, which is processed by the underlying web server infrastructure. When an attacker crafts a malicious HTTP request containing specially designed headers via this parameter, they can inject additional header fields that are subsequently interpreted by the web server rather than being treated as opaque data. This lack of sanitization allows the injection to persist through the application layer and reach the backend processing logic, creating a pathway for unauthorized information disclosure.
The operational impact is significantly amplified by the exploitation of the X-Sendfile mechanism present in many modern web servers such as Nginx or Apache with specific modules enabled. The X-Sendfile directive allows an application to delegate file serving to the web server itself, which can improve performance but introduces security risks if input validation is insufficient. In this scenario, the attacker injects a header that sets the path of the file to be served by the web server directly. Because the vulnerability exists in start-page-loader.cgi and affects unauthenticated users, there are no authentication checks or authorization filters applied before the request reaches the X-Sendfile handler. Consequently, an attacker can specify absolute paths to sensitive system files, configuration data, credentials, or other proprietary information stored on the host machine, leading to a complete compromise of confidentiality for those resources.
From a classification perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically within an HTTP header context often categorized under CWE-113: Improper Negotiation of Content Type or CWE-93: Improper Response Splitting. The exploitation technique leverages the web server's functionality to bypass application-level security controls, which maps closely to ATT&CK techniques related to Collection and Exfiltration over Alternative Protocol, as well as potential paths for Initial Access if such files contain credentials that can be used for further lateral movement. The ability to read arbitrary files without authentication places this vulnerability in the highest severity tier due to its direct impact on data integrity and confidentiality across a wide range of affected versions.
The scope of this vulnerability is broad, impacting ADM software versions from 4.1.0 through 4.3.3.RWC1 as well as versions 5.0.0 through 5.1.4.RL21. Organizations running these specific builds are at immediate risk if the service is exposed to untrusted networks or the internet. Mitigation strategies must prioritize applying vendor-provided patches that address the input validation flaws in start-page-loader.cgi immediately upon release. In environments where patching cannot be implemented instantly, network-level controls such as Web Application Firewalls should be configured to detect and block HTTP requests containing suspicious header injections or anomalous state parameter values. Additionally, restricting access to the ADM management interface to trusted IP addresses via firewall rules can reduce the attack surface by preventing unauthenticated remote actors from reaching the vulnerable endpoint altogether.