Open STA Manager 2.3 contains a path traversal flaw that allows an authenticated user to download arbitrary files by manipulating the 'file' parameter in the backup module. By sending a crafted GET request to modules/backup/actions.php with op=getfile and a sequence of '../', the attacker can read files located outside the intended directory, potentially exposing sensitive configuration, credentials, or system files. The flaw is a CWE-22 path traversal vulnerability that directly undermines data confidentiality on the server.

The affected product is Open STA Manager, specifically version 2.3. No other versions are listed in the CNA data, so the risk applies to installations running the 2.3 release.

The CVSS score of 7.1 indicates a high severity. Based on the description, the vulnerability requires authentication; therefore the attack vector is inferred to be local to the web application layer. The EPSS score is not available, so the exploitation probability remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. A public exploit is referenced on exploit-db, suggesting that the flaw can be practically abused. The overall risk to systems running Open STA Manager 2.3 is moderate to high, with a strong potential for confidential data exposure.