Tencent Mass Service Engine in Cluster (MSEC) suffers from an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability. This allows a remote, unauthenticated attacker to craft POST requests with directory traversal sequences ('../') to bypass directory restrictions. Successful exploitation enables the attacker to upload a webshell and execute arbitrary code as root on the target system. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

An attacker can gain root-level code execution on the affected device remotely without authentication. This leads to full system compromise, including confidentiality, integrity, and availability impacts rated as high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected service and monitor for suspicious POST requests containing directory traversal patterns.