This vulnerability affects the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC. An authenticated remote attacker with administrative-level privileges can exploit improper validation of pathname inputs during file upload to write arbitrary files to arbitrary locations on the affected device. The flaw is due to insufficient sanitization of directory traversal character sequences in the file path parameter, enabling path traversal attacks. The affected versions explicitly include 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0.

Successful exploitation allows an attacker with administrative privileges to write arbitrary files anywhere on the affected system, potentially leading to unauthorized modification of system files or configuration. The vulnerability does not impact confidentiality or availability directly but compromises integrity. The CVSS score of 4.9 reflects a medium severity with high impact on integrity but no impact on confidentiality or availability.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Until a patch is available, restrict administrative access to trusted personnel only and monitor for suspicious file upload activity. Since the vulnerability requires administrative privileges, limiting access reduces risk.