A directory traversal vulnerability exists in core\\admin\\ajax\\developer\\extensions\\file-browser.php in BigTree CMS through 4.2.18 on Windows allowing attackers to read arbitrary files via ..\\ sequences in the directory parameter.