The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation
External Control of File Name or Path The product allows user input to control or influence paths or file names that are used in filesystem operations.