NukeViet versions prior to 4.6.00 contain a path traversal vulnerability in the Edit Comment admin function that allows an authenticated administrator to delete arbitrary files within the application root. By injecting a crafted 'attach' parameter with a specific padding and traversal sequence, an attacker can cause deletion of critical files such as 'config.php', leading to application outage. The vulnerability arises from insufficient validation of the 'attach' parameter before file deletion. A fix has been implemented that validates the file path to ensure it remains within the intended upload directory.