Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content as demonstrated by file modifications on Windows in the context of NT AUTHORITY\\SYSTEM. This could lead to denial of service elevation of privilege or unspecified other impact.