Grav before version 2.0.16 has a path traversal vulnerability in the MediaUploadTrait::deleteFile() function. Authenticated users with media management permissions can exploit this flaw to delete arbitrary files by using directory traversal sequences in filenames. The vulnerability arises because the method only validates the basename of the filename but does not properly sanitize directory paths containing '../' sequences, which are passed to the unlink() function. This allows deletion of files outside the intended media storage directory.