Cross-user file access and modification via path traversal

Path traversal in AList before 3.57.0 allows remote authenticated users to access and modify other users' files. The fsmanage and fsbatch handlers directly join attacker-controlled names, source names, and new names to validated directories without enforcing that the resolved path remains beneath the authorized base. Exploitation requires a non-guest account with file-operation permission and multiple users sharing one storage mount; it permits cross-user reads, copies, moves, renames, and deletions.