Arbitrary file delete vulnerability in method ugw-restore

A remote attacker with user credentials can delete any file on the system through the ugw-restore method because the system doesn't properly check what files they're trying to delete.

The ugw-restore method fails to validate user-supplied file paths, allowing an authenticated remote attacker to delete arbitrary files on the system. The vulnerability requires valid user privileges but lacks proper input sanitization on the file deletion parameter, resulting in potential loss of critical system or user data.