LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')