Authenticated file disclosure and deletion via unchecked recursion

Authorization bypass in File Browser before 2.63.22 allows remote authenticated users to read, relocate, or delete denied files. The copy, rename, and delete handlers authorize only the operation root, then walk and mutate every descendant without applying path rules. An ordinary account needs the relevant create, rename, or delete permission, an allowed parent containing a denied descendant, and an allowed destination for copy or rename.