Description
This script is vulnerable to arbitrary file deletion.
This issue allows an attacker to influence calls to the 'unlink()' function and delete arbitrary files. Due to a lack of input validation, an attacker can supply directory traversal sequences followed by an arbitrary file name to delete specific files.
Remediation
Your script should filter metacharacters from user input.
References
Related Vulnerabilities
IBM WebSEAL Improper Input Validation Vulnerability (CVE-2021-20496)
Oracle HTTP Server Improper Input Validation Vulnerability (CVE-2020-35169)
WordPress Plugin SI CAPTCHA Anti-Spam Serving Spam (3.0.2)
Ruby Improper Input Validation Vulnerability (CVE-2009-5147)
Drupal Improper Input Validation Vulnerability (CVE-2019-6339)