Arbitrary file write and deletion via traversal

Path traversal in SpinetiX Fusion 3.4.8 and earlier allows remote authenticated users to write backup files or delete arbitrary files. The index.php backup/create and backup/delete routes use traversal-bearing name and id parameters without confining the resulting paths. A logged-in Fusion account can place backup archives outside the intended directory or remove files accessible to the web process.