A security vulnerability exists that allows any user who has permission to add a file in the Documents and Media portlet to delete any file on the server.