Authenticated file disclosure via substring path validation

Absolute path traversal in CRMEB 5.2.2 allows remote authenticated users to read arbitrary server files through the openfile endpoint. The openfile function checks whether the raw filepath merely contains the application-root string, then normalizes the path and passes it to file_get_contents, allowing parent-directory segments to escape the root. Access requires an administrator bearer token and file token; successful exploitation discloses files readable by the web-service account.