CVE-2022-26149: Unrestricted Upload of File with Dangerous Type in MODX Revolution

modx/revolution Updated 02 Oct 2025

Summary

27/02/2022

Disclosed on

CVE-2022-26149

CVE

No i

Fix available

High

Severity

7.2

CVSS Score

CVE-2022-26149: Unrestricted Upload of File with Dangerous Type in MODX Revolution. Affects modx/revolution versions < 2.8.3-pl. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

MODX Revolution is a content management system (CMS) that allows users to create and manage websites. It provides a flexible and customizable platform for building websites and web applications. However, a vulnerability has been discovered in MODX Revolution versions up to 2.8.3-pl that allows remote authenticated administrators to execute arbitrary code by uploading an executable file. This vulnerability arises from the ability of administrators to change the Uploadable File Types setting, which can lead to the upload of dangerous files.

Vulnerability Detail

The vulnerability in MODX Revolution allows authenticated administrators to upload executable files, which can then be executed on the server. This can lead to arbitrary code execution and potential compromise of the server. The Uploadable File Types setting, which determines the file types that can be uploaded, can be modified by administrators, allowing them to bypass any restrictions on file types. This vulnerability has a CVSS score of 7.2, indicating a high severity level.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a temporary workaround, administrators can disable file uploads or restrict the Uploadable File Types setting to only allow safe file types. This can help mitigate the risk of uploading and executing dangerous files. However, it is important to note that this is only a temporary solution and updating to the latest version of MODX Revolution is still recommended.

Conclusion

In conclusion, the vulnerability in MODX Revolution allows authenticated administrators to upload and execute arbitrary code on the server. To mitigate this risk, it is important to update to the latest version of MODX Revolution, restrict the Uploadable File Types setting, and regularly monitor file uploads. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for modx/revolution →