GitHub Advisoryadvisory · Packagist

GHSA-cgrv-6h2h-6f7v MODX Revolution Directory Traversal Vulnerability

HIGH Published 2022-05-17 Modified 2025-04-22 Official page ↗
Aliases
CVE-2017-9067
Ecosystem
Packagist
Packages
modx/revolution
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2025-04-22

Affected packages

• Packagist modx/revolution: < 2.5.7 → fixed in 2.5.7

Description

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

Related

Alias · CVE (1)

  • CVE-2017-9067 In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References