Authenticated file disclosure via self-registration path traversal

Path traversal in GoAnywhere MFT before 6.8.3 allows remote authenticated users to read files above their intended Web Client directory. Self-registration accepts crafted usernames or profile values for dynamic folder paths without rejecting traversal separators, creating Web User configurations that resolve outside the assigned directory. Exposure requires Web Client self-registration and a template using dynamic variables; the resulting account can read files at higher directory levels but cannot modify or delete them through this flaw.