You are creating a shell command without properly converting the file name into a shell literal.

You could avoid the shell by using the multi-argument form of system, or you could delete the file using unlink instead of running another program.