Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks as demonstrated by \POST /PY/EMULATION_GET_FILE\ or \POST /PY/EMULATION_EXPORT\ with FileName=../../../passwd in the POST data.