Green CMS 2.x permits authenticated attackers to extract any file or directory by injecting directory traversal characters into the theme_name parameter or by supplying base64-encoded paths to the downfile action. This flaw allows the disclosure of sensitive files stored outside the intended directories, exposing confidential data such as configuration files or application secrets.

The vulnerability affects all installations of Green CMS 2.x released by Greencms. No specific sub‑versions have been identified, but the flaw exists in the 2.x series identified by the vendor.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation today. The flaw is not listed in the CISA KEV catalog. Exploitation requires a valid user session, so the risk is primarily internal; an authenticated attacker can download arbitrary files, potentially leading to further compromise if privilege escalation is possible. The likely attack vector is an authenticated web session manipulating the theme export or download parameters.