Privileged out-of-directory file write via path traversal

Path traversal in SAP MII 15.4 and 15.5 allows remote authenticated users to write files outside an intended directory. SAP has not identified the affected functions; it states that they insufficiently validate crafted file paths before writing content. Exploitation requires high privileges, subsequent access to attacker-influenced content by a legitimate user, and conditions outside the attacker’s control; successful writes can affect other components and compromise their data or operation.