CVE-2018-1000207

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

• CWE-732

• https://github.com/a2u/CVE-2018-1000207Broken Link, Third Party Advisory
• https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68Patch, Third Party Advisory
• https://github.com/modxcms/revolution/pull/13979Exploit, Third Party Advisory
• https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4Exploit, Third Party Advisory
• https://github.com/a2u/CVE-2018-1000207Broken Link, Third Party Advisory
• https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68Patch, Third Party Advisory
• https://github.com/modxcms/revolution/pull/13979Exploit, Third Party Advisory
• https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4Exploit, Third Party Advisory

Published

Jul 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000201ruby-ffi version 1.9.23 and earlier has a DLL loading issue …
• CVE-2018-1000202A persisted cross-site scripting vulnerability exists in Jen…
• CVE-2018-1000203Soar Labs Soar Coin version up to and including git commit 4…
• CVE-2018-1000204Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_…
• CVE-2018-1000205U-Boot contains a CWE-20: Improper Input Validation vulnerab…5.5
• CVE-2018-1000206JFrog Artifactory version since 5.11 contains a Cross ite Re…
• CVE-2018-1000208MODX Revolution version <=2.6.4 contains a Directory Travers…
• CVE-2018-1000209Sensu, Inc. Sensu Core version Before version 1.4.2-3 contai…
• CVE-2018-1000210YamlDotNet version 4.3.2 and earlier contains a Insecure Dir…
• CVE-2018-1000211Doorkeeper version 4.2.0 and later contains a Incorrect Acce…
• CVE-2018-1000212Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000213Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…