{"id":"GHSA-j8jp-9x42-4pj5","aliases":["CVE-2022-26149"],"title":"Unrestricted Upload of File with Dangerous Type in MODX Revolution","description":"MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.","severity":"high","score":7.2,"published":"2022-02-27T00:00:14.000Z","modified":"2023-11-08T04:08:53.371Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"modx/revolution","ranges":[{"events":[{"introduced":"0"},{"last_affected":"2.8.3-pl"}],"type":"ECOSYSTEM"}],"versions":["v2.7.0-pl","v2.7.1-pl","v2.7.2-pl","v2.7.3-pl","v2.8.0-pl","v2.8.1-pl","v2.8.2-pl","v2.8.3-pl"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-26149","https://github.com/modxcms/revolution","https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt","http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html"],"sources":[{"name":"OSV","id":"GHSA-j8jp-9x42-4pj5","modified":"2023-11-08T04:08:53.371407Z","url":"https://osv.dev/vulnerability/GHSA-j8jp-9x42-4pj5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}]}