An attacker with authorized access can perform a path traversal within Microsoft Dynamics NAV 2018, causing the application to resolve a file path outside its intended directory boundary. This flaw can be used to elevate the attacker’s privileges over the network.

Microsoft Dynamics NAV 2018 is vulnerable. The flaw is present in the standard distribution of this product; no version qualifiers were specified in the vendor data.

The CVSS score of 8.8 indicates severe impact. The EPSS score is not available, so current exploitation likelihood is unknown, and the vulnerability is not listed in CISA KEV. The likely attack vector, inferred from the description, is a network attack performed by a legitimate user who can exploit the insufficient path restriction to gain higher privileges.