HorizontCMS v1.0.0-beta.2 exists to contain an arbitrary file download vulnerability via the component /admin/file-manager/.
horizontcms project horizontcms 1.0.0