Arbitrary file delete vulnerability in method ugw-restoreinfo

A remote attacker with user access can delete any file on the system through the ugw-restoreinfo method because the system doesn't properly validate what files are being deleted. This is dangerous because it can destroy important data or system files.

The ugw-restoreinfo method fails to validate user-supplied file path inputs, allowing authenticated remote attackers to delete arbitrary files on the system (CWE-73: External Control of File Name or Path). The vulnerability requires valid user credentials but lacks path traversal protections or whitelist restrictions, resulting in confidentiality and integrity impact through unauthorized file deletion.