The SQL scalar function "clear_plugin_cache(plugin)" in "namespace/other_functions.go" passes the caller-supplied "plugin" argument directly to "path.Join" and then to "os.RemoveAll", with only an empty-string check as a guard. Because "path.Join" silently resolves ".." segments, a low-privileged bearer-token holder can submit "SELECT clear_plugin_cache('../../../../tmp/target')" to the "/v1/query" HTTP endpoint and delete any directory reachable by the server process. In the verified scenario, a directory outside "$XDG_CACHE_HOME/anyquery/plugins/" was successfully deleted, confirming full path-traversal exploitation.