Chaining a path traversal in the firmware update endpoint into unauthenticated remote code execution as root on the appliance.