Authenticated arbitrary file deletion via path traversal

Path traversal in SonicWall SMA 100 Series 10.2.1.14-75sv and earlier allows remote authenticated users to delete arbitrary files. The sonicfiles.py download_tar path concatenates untrusted swcctn and timestamp values beneath /tmp without normalizing traversal sequences, then passes the resulting path to a root-privileged file operation. SSLVPN user privileges and a valid session cookie are required; deleting persist.db reboots the appliance and resets the administrator account, enabling privilege escalation.