The vulnerability is an improper limitation of a pathname to a restricted directory, which allows a low‑privileged attacker with remote access to read or write arbitrary files on the system. This Path Traversal flaw could lead to disclosure of sensitive information or modification of critical configuration files, compromising the integrity of the storage appliance. The weakness is identified as CWE‑22, indicating that untrusted input is not properly sanitized before file system access.

Dell PowerProtect Data Domain appliances may be affected. Version ranges include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. These versions are listed in Dell’s advisory as susceptible to the path traversal flaw.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS value means the exploitation probability is not quantified but the flaw could be actively used on systems with remote access. The vulnerability is not yet in the CISA KEV catalog, yet the combination of remote access and local path traversal makes it attractive to attackers. The most likely attack vector is a remote attacker exploiting the exposed management interface or API, which the system treats as trusted for file operations, allowing arbitrary file access.