CVE Request: file inclusion(traversal/manipulation) in modx revolution 2.5.1

[陈瑞琦 <chenruiqi () b 360 cn>]

I found a file inclusion(traversal/manipulation) vuln in modx revolution 2.5.1


Title: Path travel in modx version 2.5.1
Author: Chen Ruiqi, Chenruiqi () b 360 cn, @Codesafe Team
Download Site: www.modx.com<http://www.modx.com/>
Vendor: modx
Vendor Contact: security () modx com
--------------------------------------------------------------------------------------------------------
Discription:
MODX (originally MODx) is a free, open source content management system and web application framework for publishing 
content on the world wide web and intranets. MODX is licensed under the GPL, is written in the PHP programming 
language, and supports MySQL and Microsoft SQL Server as the database. It was awarded Packt Publishing's Most Promising 
Open Source Content Management System in 2007.[1](wiki)
-----------------------------------------------------------------------------------------------------------
Vulnerability:
By using relative paths and guessing locations on a server modx is installed on, an attacker can get the file system 
structure and delete any folder from a target server that the process running modx has permission. The attacker needs 
administrator privileges on the modx site to perform this attack.

--------------------------------------------------------------------------------------------------------

Fix:

https://github.com/modxcms/revolution/pull/13177

update to version 2.5.2


Could you assign CVE ID for this?


Thank you

Chen Ruiqi
Codesafe Team