Arbitrary file read via extension path traversal

Path traversal in SiteFusion Application Server 6.6.0 through 6.6.6 allows remote authenticated users to read arbitrary server files. In getextension.php, the Extension Handler joins the extension query value to the extensions directory and checks only for slash characters and file existence, without resolving the resulting path or enforcing root containment. Reachability is limited to an adjacent authenticated user in the CNA assessment, and the documented consequence is file disclosure without modification or service interruption.