send_data(u_int32_t id, const u_char *data, int dlen)
{
	debug("request %u: sent data len %d", id, dlen);
	send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
}

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.