A path traversal flaw exists in Dell PowerProtect Data Domain that allows a high privileged local user to craft requests that reference files outside the intended directory. Exploitation of this flaw can cause the system to become unable to serve legitimate requests, effectively denying service to legitimate users. The weakness is classified as CWE‑24, indicating improper validation of file paths.

Dell PowerProtect Data Domain is affected. Versions spanning feature release 7.7.1.0 through 8.8, LTS2024 release 7.13.1.0 to 7.13.1.80, LTS2025 release 8.3.1.0 to 8.3.1.40, and LTS2026 release 8.6.1.0 to 8.6.1.20 are vulnerable.

The vulnerability receives a CVSS score of 3.4, indicating low overall severity. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. A local attacker with high privileges is required to exploit the path traversal, suggesting that external attackers without privileged access cannot directly leverage the flaw, but insider threats or compromised local credentials pose the primary risk. Successful exploitation results in denial of service, impacting system availability.