A local authenticated user can use the Zone Alias Import feature to upload content and, because path validation is insufficient, write files outside the intended directory. The flaw permits unauthorized creation or modification of files on the system. Classified as CWE‑22, this path traversal weakness can be exploited by an attacker who already has access, potentially leading to system integrity compromise or malicious data exposure. Based on the description, it is inferred that the attacker must have local authenticated privileges to use the feature.

Brocade SANnav is affected, specifically versions earlier than 3.0.0a. Brocade released security updates in SANnav 3.0.0a and 3.0.1 to address the issue, and any earlier releases remain vulnerable.

The CVSS score of 6.9 places the flaw in the medium–high severity range, yet the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authenticated user to first log in to SANnav. Based on the absence of a remote entry point, it is inferred that initial spread is limited. Once authenticated, the attacker can run the Zone Alias Import flow and persist files outside the intended directory, which may allow privilege escalation or further compromise. While the lack of a remote entry point limits initial spread, the local user privilege requirement still constitutes a moderate risk for affected installations.