A directory traversal and file upload flaw in Check Point Quantum Security Management enables an unauthenticated attacker to upload a crafted script and have it executed on the management server. The vulnerability combines an insecure file upload mechanism with a breach of directory boundaries, allowing remote code execution on the server without authentication.

The vulnerability applies to Check Point Quantum Security Management. No specific version information is provided, so any release that still contains the vulnerable upload handling code may be impacted. Administrators should check the exact build running in their environment.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score is 20%, indicating a non-negligible probability of exploitation. The unauthenticated nature and ability to run arbitrary code suggest a high likelihood of exploitation, especially if the management server is accessible from untrusted networks. The vulnerability is listed in the CISA KEV catalog.