Navigate CMS 2.8.5 contains a path traversal flaw in navigate_download.php that lets an authenticated user download any file by manipulating the id parameter. By inserting directory traversal sequences such as ../../../cfg/globals.php, an attacker can retrieve sensitive configuration files and other system files that should not be publicly exposed, leading to a confidentiality breach.

The vulnerability affects Navigate CMS version 2.8.5. No other versions are listed as vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the CMS, after which they can craft a GET request with a traversal payload. Because authentication is required, the risk is lower than a remote code execution vulnerability but still significant for confidential data exposure.