The flaw is a path‑traversal weakness that lets an authorized user create or access files outside a restricted directory within Microsoft Dynamics Business Central. By exploiting an improperly limited pathname, an attacker can gain higher privileges over the network, potentially compromising the entire system.

Microsoft Dynamics NAV 2018 is the affected product. No specific sub‑versions beyond the product are listed in the CNA data.

The likely attack vector is internal or remote network traffic that an authenticated user can influence, such as uploading or configuring files that the application later processes. The high CVSS score of 8.8 reflects the serious impact of this privilege escalation. Although its EPSS score is less than 1%, indicating a low probability of exploitation, the vulnerability is not listed in the CISA KEV catalog, and the combination of a known exploitation technique and a high severity rating indicates that this is a significant threat to systems that have not been patched.