Pimcore CMS build 3450 suffers from an issues where it is possible for an administrative user with the ‘assets’ permission to overwrite system configuration files via exploiting a directory traversal vulnerability.