Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities allow an authenticated attacker to bypass permissions by sending specially crafted HTTP requests, specifically exploiting the disk_part POST parameter. The issue is classified as critical with a high CVSS score of 9.1.