Unauthenticated file read and deletion via path traversal

Path traversal in HGiga OAKlouds Organization and Webbase allows remote attackers to read and delete server files without authentication. The affected download handlers accept attacker-controlled file paths in request parameters, return the referenced file, and then delete it without confining the path to an intended directory. No account is required; exposure extends to files accessible to the application process, with disclosure followed by destructive removal.