Authenticated arbitrary file deletion via path traversal

Path traversal in update_guide.php in DedeCMS 5.7.112-UTF8 allows remote authenticated users to delete arbitrary files via the files parameter. The handler accepts dot-dot path segments in files and passes the resulting out-of-directory pathname to deletion logic without neutralizing traversal. A valid low-privilege session is required, and deletion is bounded by the web-server account's filesystem permissions but can damage site content or configuration.