The vulnerability exists because the getThemeFolder() function in admin/controller/editor/revisions.php returns an attacker-controlled theme parameter without proper sanitization, allowing path traversal sequences. The backupFolder() function concatenates this unsanitized theme parameter beneath the DIR_THEMES directory before file operations like file_get_contents() or unlink() are performed on .html files in backup directories. Although sanitizeBackupFileName() sanitizes the file parameter, it does not sanitize the theme directory component, enabling traversal outside the web root. Exploitation requires an authenticated user with Editor role and editor/* permissions, a valid admin session, and a CSRF token. The vulnerability can lead to unauthorized reading or deletion of backup files. The issue is resolved in version 1.0.8.5.

An attacker with Editor role and editor permissions can read sensitive exported site content or delete backup .html files outside the intended backup directory by exploiting path traversal. This could result in information disclosure or loss of backup data. The impact is limited by the need for authentication, valid admin session, CSRF token, and filesystem write permissions for deletion.

Upgrade to version 1.0.8.5 or later, where this vulnerability is fixed. Until then, restrict Editor role permissions and ensure strict session and CSRF protections. No other official mitigation is provided.