Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files