CVE-2017-9069: MODX Revolution allows overwriting .htaccess

May 17, 2022 (updated April 22, 2025)

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.

References

citadelo.com/en/2017/04/modx-revolution-cms
github.com/advisories/GHSA-23gj-x27g-r34f
github.com/modxcms/revolution
github.com/modxcms/revolution/pull/13423
nvd.nist.gov/vuln/detail/CVE-2017-9069

Code Behaviors & Features

Detect and mitigate CVE-2017-9069 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →