A directory traversal vulnerability exists in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC. This flaw allows an unauthenticated remote attacker to send crafted requests to access protected files on the affected device without authentication. The vulnerability arises from insufficient validation of directory traversal sequences in user-supplied paths during provisioning resource requests. The CVSS score is 5.3, indicating medium severity.