A directory traversal flaw (CWE‑31) in the Web portal of Mitel MiVoice Office 400 allows an authenticated attacker to specify a file path that resolves outside the intended directory. By exploiting this weakness, the attacker can delete any file located on the device that the authenticated account is allowed to access, including files belonging to the Mitel application or the underlying Linux filesystem. Removing critical files can bring the system down or corrupt its functionality, constituting a denial‑of‑service condition and exposing sensitive data if confidential files are deleted.

Mitel MiVoice Office 400, accessed via the HTTPS web portal on TCP port 443, within the Maintenance → File Management → File Browser section. No version information is currently provided so all deployments of this product are considered potentially vulnerable until a patch is applied.

The vulnerability has a CVSS score of 8.4, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers must first authenticate to the web portal, which limits exposure to compromised or stolen credentials. The most likely attack vector is the HTTPS interface; the exploit requires only the ability to request a delete operation with a manipulated file path. If credentials are compromised or a user with sufficient privileges enters a malicious link, the resulting file deletions can lead to system crashes or data loss. Given the high impact and the need for authentication, the risk remains significant for organizations that have not applied a vendor patch.