Authenticated file write and deletion via path traversal

Path traversal in Centreon Open Tickets on Linux before 24.04.7, 24.10.8, and 25.10.3 allows remote authenticated users to write or delete files. The Open Tickets file-upload path accepts attacker-controlled traversal sequences when choosing the destination, allowing writes or deletions outside the intended upload directory; Centreon has not disclosed the affected handler or parameter. A low-privileged authenticated account and network access to the Centreon web interface are required; arbitrary writes or deletions can corrupt application data or interrupt service.