The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating system files.
CWE-23, CWE-22