This vulnerability involves improper limitation of a pathname to a restricted directory in Tenable Agent 11.2.0 and 11.1.3 and lower. A privileged attacker can exploit this path traversal issue to write files outside the designated plugin directory, which may enable remote code execution. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not yet provided a patch or official remediation guidance.

Successful exploitation allows a privileged attacker to write arbitrary files outside the intended directory, potentially leading to remote code execution. This can compromise system confidentiality, integrity, and availability.

No official patch or remediation is currently available from the vendor. Organizations should monitor vendor advisories for updates. Until a fix is released, restrict privileged access to the Tenable Agent host to trusted administrators only and consider additional controls to limit the risk of exploitation.