By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
ptc vuforia studio