ASUS BMC's firmware: path traversal - Get video file function

A flaw in ASUS BMC's web interface allows an authenticated administrator to access files outside the intended directory using path traversal. An attacker with admin credentials can bypass directory restrictions and read sensitive system files.

The 'Get video file' function in ASUS BMC's web management page fails to sanitize user-supplied path parameters, enabling path traversal attacks (CWE-22). An authenticated attacker with administrator privileges can craft malicious requests containing traversal sequences (../) to access arbitrary system files beyond the intended video directory.