Overview
- Project: MODX Revolution (core)
- CVE ID: Pending
- Affected Versions: All versions
- Fixed Version: 3.2.3 and 2.8.9
- Release Date: 2026-07-21
- Severity: Pending—impact varies by site configuration. A formal CVSS score will be published with the full technical disclosure.
Vulnerability Details
Type
Improper Input Validation, with potential escalation to Remote Code Execution
Description
A vulnerability has been identified in MODX Revolution related to insufficient input validation. On its own, this can allow injection of arbitrary content into site templates. Depending on site-specific factors, impact can escalate further, up to and including remote code execution. The issue has been present for an extended period and was identified during an internal security review.
We are withholding further technical detail—including attack vector, affected configuration criteria, and proof-of-concept information—until patch adoption is broad enough for fuller disclosure to be responsible. A follow-up advisory with complete technical details will be published at that time.
Attack Vector
Not published in this preliminary advisory.
Affected Systems
Some installations are affected more directly than others depending on configuration. We are not publishing the specific criteria at this time. All MODX Revolution installations on the 2.8.x and 3.x branches should upgrade regardless of known configuration, since exposure can’t be reliably self-assessed without the full technical detail.
Mitigation
Upgrade required: Upgrade to 3.2.3 or 2.8.9 as soon as possible.
MODX Cloud customers: infrastructure-level mitigations have been applied. This reduces risk while you upgrade but doesn’t replace patching your site.
Credits
- Discovery: Elizabeth Southwell (Omeryl)
- Resolution: Jason Coward (opengeek)
- Coordination: MODX Security Team
Timeline
- Discovery Date: 2026-07-20
- Fix Development: 2026-07-21
- Preliminary Disclosure: 2026-07-21
- Full Technical Disclosure: To be announced
References
- MODX Security Team Contact: [email protected]
- Fixed Version Downloads: Revolution 3.2.3, Revolution 2.8.9
Revision History
- 2026-07-21: Preliminary advisory published. Full technical disclosure to follow once patch adoption is sufficient.