An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.
CWE-94, NVD-CWE-noinfo