Arbitrary file write via upload path traversal

Path traversal in Arcserve Unified Data Protection 8.1 and 9.2 allows remote authenticated users to write arbitrary files via an import request. ImportNodeServlet uses an attacker-controlled upload path without constraining traversal segments, so the file escapes its report temporary directory and is written anywhere accessible to the UDP Console’s SYSTEM account. Valid Console access is required for this CVE alone; replacing a privileged executable can compromise the Windows host, while chaining the separate wizardLogin flaw removes that authentication gate.