In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')