Description
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95096
Patch, Vendor Advisory x_refsource_confirm
https://github.com/modxcms/revolution/pull/13177
Release Notes x_refsource_confirm
https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt
Scores
CVSS v3
7.3
EPSS
0.0176
EPSS Percentile
75.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-22
Status
published
Products (1)
modx/modx_revolution
< 2.5.2
Published
Dec 24, 2016
Tracked Since
Feb 18, 2026