Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.