There is a small bug related with security in filemanager config.php . If someone knows the url for filemanager (i.e. http://xxxxxxx/admin/ckeditor/filema...ts_description[2]&CKEditorFuncNum=2&langCode=en), then he/she can view, delete, or change the files.

To fix that:

FIND:
if (!isset ($_SESSION ['osCAdminID']))
on line 29

CHANGE TO:
if (!isset ($_SESSION ['osCAdminID'])) exit;

More...