Arbitrary file deletion via traversed emoji path

Path traversal in Owncast before 0.1.3 allows remote authenticated users with administrator access to delete arbitrary server files. The emoji deletion handler joins the JSON name value to the custom-emoji directory and passes the resulting path to os.Remove without rejecting traversal. Administrator credentials and network access to the admin API are required; deletion can reach any file writable by the Owncast process.