Arbitrary file deletion via manipulated download path

Path manipulation in GL.iNet router firmware allows remote attackers to delete arbitrary device files through the download interface. The interface accepts an attacker-selected path parameter as the file deletion target without confining it to an authorized download location. No credentials or user interaction are required, but the attacker must reach the router from an adjacent network; deletion is limited to files accessible to the interface process.