					$filename = isset($_REQUEST[$request]) ? trim($_REQUEST[$request]) : false;
					if (!$filename || empty($filename)) {
						continue;
					}
					if ($filename == wCMS::get('config', 'theme')) {
						wCMS::alert('danger', 'Cannot delete currently active theme.');
						wCMS::redirect();
						continue;
					}
					if (file_exists("{$folder}/{$filename}")) {
						wCMS::recursiveDelete("{$folder}/{$filename}");
						wCMS::alert('success', "Deleted {$filename}.");
						wCMS::redirect();
					}
				}
			}
		}
	}

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.