filebrowser versions prior to v2.63.21 do not properly canonicalize file paths before applying access control rules. This flaw allows authenticated users to bypass administrator-defined deny rules by using alternate path representations, such as case variants or backslash separators, to access files that should be denied.