HIGH8.8

GHSA-23gj-x27g-r34f

MODX Revolution allows overwriting .htaccess

Quick fix

GHSA-23gj-x27g-r34f — modx/revolution: upgrade to the fixed version with the command below.

composer require modx/revolution:^2.5.7

Details

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 2.5.7

Fixcomposer require modx/revolution:^2.5.7