AdminNeo versions prior to 5.5.1 contain a vulnerability allowing authenticated SQLite users to delete arbitrary files writable by the PHP process via the database-list drop action. The flaw arises because the drop operation does not validate file extensions or restrict deletions to known database files, unlike create and rename operations. An attacker with valid credentials and a CSRF token can submit arbitrary file paths to be unlinked, potentially deleting critical files. This vulnerability is fixed in version 5.5.1.