Arbitrary directory deletion via traversable plugin name

Path traversal in OneKeyAdmin 1.3.9 allows remote authenticated users with administrator rights to delete arbitrary directories. The plugins controller's delete method passes the request's name value directly to onekey\File::delDirAndFile, allowing ../ traversal outside the plugin directory. A valid background administrator session is required, and successful exploitation deletes attacker-selected directories accessible to the web application process.