Administrator file deletion via unfiltered path traversal

Path traversal in BlueCMS 1.6 allows remote authenticated users with administrator rights to delete arbitrary files via a crafted file_name. At line 210 of admin/database.php, the deletion path accepts file_name without filtering and uses traversal sequences in the filesystem deletion operation. Administrator access is required; successful exploitation removes attacker-selected files but provides no reported read or code-execution capability.