A directory traversal flaw in the file upload feature of Biztalk360 allows an authenticated user to place files outside the intended directory. This can overwrite configuration files or drop malicious payloads, leading to unauthorized file writes and the potential for remote code execution.

Biztalk360 versions older than 11.5, deployed on servers that use the default upload interface, are susceptible. The flaw is present in the upload component that accepts user‑supplied files. Any system running a pre‑11.5 release of Biztalk360 is affected.

The vulnerability scores a CVSS of 8.3, signifying high severity, and an EPSS below 1%, indicating a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. An attacker must be authenticated to the Biztalk360 service to abuse the flaw, but once authenticated they can write files beyond the intended scope, offering a path to compromise the system.