What is GHSA-cgrv-6h2h-6f7v?

GHSA-cgrv-6h2h-6f7v is a security advisory published by GitHub Security Advisories with High severity. MODX Revolution Directory Traversal Vulnerability

Which CVE IDs does GHSA-cgrv-6h2h-6f7v cover?

GHSA-cgrv-6h2h-6f7v covers the following CVE IDs: CVE-2017-9067. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cgrv-6h2h-6f7v?

GHSA-cgrv-6h2h-6f7v has a CVSS v3 base score of 7.0, published by GitHub Security Advisories.

Which products are affected by GHSA-cgrv-6h2h-6f7v?

GHSA-cgrv-6h2h-6f7v affects 1 product, including: composer/modx/revolution:\u003c 2.5.7.

GHSA-cgrv-6h2h-6f7vHighCVSS 7.0

MODX Revolution Directory Traversal Vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

April 22, 2025

🔗 CVE IDs covered (1)

CVE-2017-9067 →

📋 Description

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

🎯 Affected products1

composer/modx/revolution:< 2.5.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-9067
https://github.com/modxcms/revolution/pull/13422
https://github.com/modxcms/revolution/pull/13428
https://citadelo.com/en/2017/04/modx-revolution-cms
https://github.com/advisories/GHSA-cgrv-6h2h-6f7v