The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory, known as a path traversal flaw. It allows a high-privileged attacker who can reach the Avamar system remotely to delete any file on the appliance's file system, potentially compromising data integrity and availability. This is a direct consequence of the CWE-22 weakness, leading to destructive operations rather than code execution or data exfiltration.

Dell Avamar Server and Dell Avamar Virtual Edition, versions earlier than 19.10 SP1 with CHF338912, as well as Dell PowerProtect DP Series Appliance (IDPA), are susceptible to this flaw. These products rely on proper pathname limitation to prevent file system traversal.

The CVSS score of 6.5 indicates a medium severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is low at this time. The vulnerability can be used by an attacker who possesses high-privileged remote access to the Avamar appliance to delete arbitrary files, potentially leading to data loss or service disruption. The flaw is not listed in the CISA KEV catalog, implying no publicly known active exploits.