Arbitrary file read and deletion via sanitizer bypass

Path traversal in givanz Vvveb 1.0.8.5 and earlier allows remote authenticated users to read or delete server files through backup actions. The sanitizeFileName() helper strips forbidden characters in one pass, allowing separated dots to join into traversal sequences that backup download and delete handlers append to the backup directory without containment checks. Exploitation requires an admin session, a CSRF token, and backup permission held by the default site_admin role; file reads expose host data, while deletion can remove configuration and reopen installation.