Warpinator prior to 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.
linuxmint warpinator