This vulnerability in Greg Ross CYAN Backup (<= 2.5.3) allows path traversal via the '.../...//' sequence, enabling an attacker with high privileges to read files outside the designated backup directories. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without affecting integrity or availability. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with high privileges can exploit this path traversal vulnerability to access sensitive files outside the intended backup scope, potentially leading to unauthorized disclosure of confidential information. There is no indication of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CYAN Backup application to trusted users only and monitor for unusual file access patterns. Avoid exposing the backup service to untrusted networks.