What’s Vulnerable › Vulnerabilities

CVE-2017-9067

• Severity: high (CVSS 7.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-05-18 · updated 2026-06-17
• Weakness: CWE-22

Description

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

Affected products

• Modx Revolution: 2.5.6
• PHP: 5.3.3

References

• https://citadelo.com/en/2017/04/modx-revolution-cms/
• https://github.com/modxcms/revolution/pull/13422
• https://github.com/modxcms/revolution/pull/13428
• https://citadelo.com/en/2017/04/modx-revolution-cms/
• https://github.com/modxcms/revolution/pull/13422
• https://github.com/modxcms/revolution/pull/13428

Get alerted when CVE-2017-9067 or the next vulnerability affects your stack