Szafir contains a path traversal vulnerability in the filename handling of uploaded files. An attacker capable of intercepting and redirecting update requests can craft a malicious XML file that is saved to an arbitrary location chosen by the attacker. This vulnerability was addressed in Szafir version 2.0 build 708.