SAP Enterprise Architecture Designer v1.0 SP04 allows an authenticated attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs.

This could be achieved by injecting malicious crafted Zip file (“Zip Slip” CVE-2018-1002204).

Some well-known impacts of Directory Traversal vulnerability are –

• attacker could overwrite, delete, or corrupt arbitrary files on the remote server