Blackwolfsec

The issue allows an attacker to bypass a filter rule using `../`, enabling them to delete or read any files on the server, as well as determine whether a file exists.

A directory traversal issue exists, allowing remote authenticated users to read or delete arbitrary files. This is achieved by providing a .. (dot dot) in the `fm selected` array parameter in the inc/files/files.ctrl.php file, leveraging back-office access.