Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt prior to 4.1.13 allow Directory Traversal.
boltcms bolt