Arbitrary file creation via path traversal

Path traversal in MikroTik WinBox before 3.21 allows remote attackers to create arbitrary files where WinBox has write permissions via a malicious router connection. The client uses filenames supplied in a downloaded router package list without rejecting directory traversal sequences, so attacker-controlled paths escape the roaming directory. Exploitation requires a victim to connect to a malicious endpoint or an attacker to intercept the connection; resulting writes are limited to the permissions of the WinBox process.