Understanding collaborator access

I'd like to understand if I give an outside vendor access to a folder in Box, what else they can see. For example if the file structure was as follows: All files / FY23 / CTV and I invite someone to CTV, can they then also access FY23 and All files? Or would they only have access to CTV and any files and sub folders in that folder? (So downstream access but not upstream?) Thanks!