Server file disclosure via unvalidated folder selections

Relative path traversal in OpenOlat before 15.5.8 allows remote authenticated users to read server files through folder downloads. The FileSelection parser accepted HTTP paths without verifying that each named item belonged to the current VFS container, so folder commands resolved attacker-selected paths outside that container. Exploitation requires an account or enabled guest access, a folder component in a course, and knowledge of an exact readable path; it does not permit file writes.