Arbitrary file read via unrestricted BIRT report path

Path traversal in AR Reporting in BMC Remedy AR System Server before 9.0 SP1 allows remote authenticated users to read arbitrary files. The embedded BIRT Viewer accepts the attacker-controlled __report value as a local or remote file path because Remedy configures the servlet without restricting it to authorized report resources. A valid application session is required, and exploitation exposes files reachable by the Mid Tier service without altering data or interrupting service.