GitHub Advisoryadvisory · Packagist

GHSA-23gj-x27g-r34f MODX Revolution allows overwriting .htaccess

HIGH Published 2022-05-17 Modified 2025-04-22 Official page ↗

Aliases: CVE-2017-9069
Ecosystem: Packagist
Packages: modx/revolution
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434
Reviewed: 2025-04-22

Affected packages

• Packagist modx/revolution: < 2.5.7 → fixed in 2.5.7

Description

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.

Related

Alias · CVE (1)

CVE-2017-9069 In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name… vulnerability

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References