Hi. I have a site which is forced to 3.1.x version because that server not have php 8 available.
So what I have to do? Is there way to patch manually without breaking php 7.4 compatibility?
It looks like this is the commit that fixes the vulnerability:
I guess you could apply the changes manually to the 3 files (especially to modX.php).
You can ignore the test file → modXTest.php.
Without knowing more details, it’s hard for me to judge how severe this vulnerability really is.
So maybe it’s not worth the effort to manually patch it.
It is absolutely worth patching for people that can’t update directly. The severity will depend on the site configuration, but generally this is one of the more serious issues I’ve seen in recent years.
UPDATE: We’re actually unable to do this due to complexity with the build process. The fix is relatively easy per the the commit that @halftrainedharry mentioned above.
We’ll be publishing 3.1.3 and a 3.0.7 patches for folks who are version locked. Likely sometime today.
Please see my note above about the additional patches.
Sorry, what instruction? Apologies if I’ve missed it!
@dejaya The commit noted by @halftrainedharry above.
Ideally, you can just upgrade to either 2.8.9 or 3.2.3. But it’s possible to make the changes to the code or to your site to prevent exposure altogether.
You can read the changes in the commit but as I’m sure you’ll understand, we’re trying to keep the specific vector as quiet as possible to prevent an exploit.
The issue exists in all versions of Revo but not all sites will be at risk.
Ah ok thanks.
Yes I updated no less than 57 sites to 3.2.3 today - but like @valokammi I have one that is currently stuck on an older version [3.0.1].
I think I’ll actually just try to fix the blocker and get it updated as that’s the adult thing to do 
Thanks for the update and the work to fix the issue - always appreciated.