Authenticated file deletion via unchecked path traversal

Path traversal in /wex/finder.php in Vedees WCMS 0.3.0 through 0.3.2 allows remote authenticated users to delete arbitrary files. The deletion handler accepts file[] values containing parent-directory segments and deletes the referenced path without confining it to the file-manager directory. An authenticated management session is required, and successful exploitation can remove files writable by the web-server process outside the intended directory.