Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.
No PoCs from references.
- https://github.com/726232111/GDideesCMS-DirectoryTraversal
- https://github.com/NulinJeriba/nvd_cve_project