The flaw is a directory traversal vulnerability in the smartgui interface of LifeSize ClearSea that allows authenticated users to manipulate path parameters to download or upload files. By crafting traversal sequences in the upload endpoint, an attacker can place files of their choosing in arbitrary locations on the system, which can be leveraged to execute arbitrary code. The weakness maps to CWE‑22.

LifeSize ClearSea version 3.1.4 is affected. No other versions or vendors were listed as impacted.

The CVSS score of 7.1 signals a high severity. EPSS is not available and the vulnerability is not listed in CISA KEV, so there is no evidence of widespread exploitation yet, but the remote nature and requirement for authentication mean that any compromised or guessed credentials could be used to exploit the system. Attackers would need network access to the smartgui interface to send the malicious requests.