This vulnerability (CVE-2025-40898) involves improper limitation of a pathname to a restricted directory (CWE-22) in Nozomi Networks Guardian. Specifically, the Import Arc data archive functionality does not sufficiently validate input file paths, allowing an authenticated user with limited privileges to perform path traversal by uploading a specially crafted archive. This can result in arbitrary file writes outside the intended directory, potentially altering device configuration or affecting availability. The CVSS 4.0 score is 7.2 (high), with network attack vector, low attack complexity, no user interaction, and privileges required.

An attacker with limited authenticated privileges can exploit this vulnerability to write arbitrary files to arbitrary locations on the device running Nozomi Networks Guardian. This may lead to unauthorized modification of device configuration or disruption of device availability, potentially impacting the security and operation of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Nozomi Networks advisories for updates. Until a fix is available, restrict access to the Import Arc data archive functionality to trusted users only and consider additional monitoring of file system changes related to this functionality.