This vulnerability arises from insufficient validation of an input parameter in the Offline archives feature of Nozomi Networks Arc. A local administrator can exploit this by crafting an archive name with path traversal sequences to delete arbitrary files on the host system where the Arc process runs with administrative privileges. This improper limitation of pathname to a restricted directory is classified as CWE-22.

An attacker with local administrative credentials to the web interface can delete arbitrary files on the host system, potentially leading to denial of service or disruption of system operations. Since the Arc process runs with administrative privileges, the impact of file deletion is elevated. There is no indication of remote exploitation or privilege escalation beyond the existing administrative access. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to archive management. No official fix or temporary workaround has been documented at this time.