XSS Vulnerability in MODX Revolution Package Allows Malicious SVG Uploads
Summary
CVE-2025-28010: MODX allows cross-site scripting (XSS) via an SVG file. Affects modx/revolution versions < 3.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MODX Revolution is a popular open-source content management system (CMS) that enables users to create and manage websites with ease. It offers a flexible architecture, allowing for extensive customization and scalability. However, prior to version 3.1.0, MODX is vulnerable to a cross-site scripting (XSS) issue that permits authenticated users to upload SVG files containing harmful JavaScript code.
Vulnerability Detail
The identified vulnerability allows authenticated users to upload SVG files that can execute malicious JavaScript code in the browsers of users viewing the profile images. This XSS vulnerability arises from insufficient validation of uploaded files, specifically SVGs, which can contain executable scripts. The potential ramifications include unauthorized actions performed on behalf of the victim, data theft, and further exploitation of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the upload of SVG files by modifying the file upload settings in your MODX configuration. Alternatively, consider sanitizing SVG files before allowing uploads to ensure they do not contain executable scripts.
Conclusion
The XSS vulnerability in MODX Revolution prior to version 3.1.0 poses a significant risk to users through the upload of malicious SVG files. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for modx/revolution →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows malicious JavaScript to be executed through uploaded SVG files.
Authenticated users of MODX prior to version 3.1.0 are affected, as they can upload SVG files that may contain malicious code.
The consequences include unauthorized actions on behalf of users, data theft, and possible further exploitation of the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating to MODX Revolution version 3.1.0 or later will patch this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for modx/revolution.
