A path traversal flaw in the setUploadMusic endpoint of the Music File Upload Service allows an attacker to manipulate the UploadMusic argument and access files beyond the intended directory. This can enable reading sensitive system files or writing arbitrary files if the service grants write permissions, potentially exposing configuration data or altering critical files. The vulnerability is tied to the fact that the upload function does not sanitize path segments, leading to direct traversal outside the designated folder.

The flaw is reported for D‑Link DCS‑700L devices running firmware version 1.03.09. Only this version of the firmware is affected; newer or legacy firmware revisions are not listed as vulnerable.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is hard‑coded to be exploitable only from devices within the same local network, so an attacker would need connectivity to that network to use the flaw. Because the target device is no longer supported and the flaw is not listed in the KEV catalog, the current risk is considered moderate but potentially significant for organizations still running the affected hardware.