The vulnerability exists in the /v1/resource/file/delete API endpoint, where the file_key parameter is not properly sanitized. This allows an attacker to specify arbitrary file paths, leading to the deletion of any file on the server. The lack of input validation and sanitization in the delete_file function of the FileClient class is the root cause of this issue.

An attacker can exploit this vulnerability by sending a crafted request to the /v1/resource/file/delete API endpoint with a file_key parameter set to the path of a file they wish to delete. For example, by setting file_key to /tmp/ngductung_pocPathTraversal, the attacker can delete the file /tmp/ngductung_pocPathTraversal on the server.

Users and administrators of the software version 0.6.0 are affected by this vulnerability. Any server running this version is at risk of arbitrary file deletion.