MODX catalogue

MODX Revolution 3.0.0-alpha3

Released 5 years ago on October 27, 2021.

Downloads GitHub release

  • MODX Revolution 3.x improper input validation

    CRITICAL
    Type
    Improper Input Validation
    Fixed in
    MODX 3.2.3-pl
    Disclosed
    July 21, 2026

    MODX Revolution 3.x (core) has insufficient input validation that can allow injection of arbitrary content into site templates. Depending on site configuration, impact may escalate to remote code execution. The issue has been present for an extended period and was identified during an internal security review. CVE and CVSS are pending. Technical detail (attack vector, affected configuration criteria, and proof-of-concept) is withheld until patch adoption is broad enough for responsible full disclosure. All 3.x installations should upgrade; exposure cannot be reliably self-assessed from this preliminary advisory alone.

    Remediation: Upgrade MODX Revolution 3.x to 3.2.3-pl or newer as soon as possible. MODX Cloud customers: infrastructure-level mitigations reduce risk during upgrade but do not replace patching your site. SiteDash Client v1.9 also includes an additional mitigation.

  • MODX allows cross-site scripting (XSS) via an SVG file

    LOW
    Type
    XSS
    Fixed in
    MODX 3.1.0-pl
    Disclosed
    March 13, 2025

    A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

    Remediation: Upgrade MODX Revolution to 3.1.0-pl or newer.

  • MODX Revolution 3.x various security patches ported from 2.x (#15843)

    MEDIUM
    Type
    Security
    Disclosed
    October 27, 2021

    MODX Revolution 3.0.0-alpha3 includes ports for various security patches in the 2.8.0 and 2.8.2 releases, including #15720 (various XSS), #15678 (unauthorized access to user information), #15643 (disallow editing/removing files to extensions that are not allowed), #15280 (XSS in resourcelist tv), and XSS in resource data view, tree, and media browser #15273.

    Remediation: Upgrade MODX Revolution 3.x to 3.0.0-alpha3 or newer.

  • MODX Revolution MODx.config XSSI hardening (#15645)

    MEDIUM
    Type
    Security
    Disclosed
    October 27, 2021

    MODX Revolution 3.0.0-alpha3 requires an auth token to access MODx.config to prevent cross-site script inclusion (XSSI) (#15645). This flaw allowed attackers to load the MODx.config data if users were logged in to the manager, without requiring access to the session token, potentially leaking configuration paths or information. MODx.config was already filtering passwords and known-sensitive information.

    Remediation: Upgrade MODX Revolution 3.x to 3.0.0-alpha3 or newer (prefer current stable 3.x).

Changelog

  • Fix accessing $modx->controller from plugins and services [#15871]
  • Fix POST requests through modTransportProvider::request [#15869]
  • Remove reference to renamed upgrade script [#15863]
  • Upgrade Smarty to v4 [#15859]
  • Use Guzzle HTTP factory [#15856]
  • Fix duplicate array key [#15860]
  • Improve text styles in package manager [#15862]
  • Fix typo in lexicon [#15853]
  • Hide denied context menu items in elements tree [#15634]
  • Fix errors in Resource\GetNodes processor [#15834]
  • Fix form customization on static resources [#15637]
  • Remove 'import resources' and 'import site' from core [#15841]
  • Remove legacy class log message in modX::loadClass [#15842]
  • Fix create tv panel broken by non-English lexicons [#15846]
  • Fix preview_file field in schema [#15847]
  • Various security patches [#15843]
  • Make CI build command agnostic to the build tool itself [#15845]
  • Refactor template variable creation [#15773]
  • Remove obsolete contentType field [#15822]
  • Allow language selection with Tab key in setup [#15823]
  • Add policy count column to policy templates [#15839]
  • Correct edit media source lexicon in tree [#15738]
  • Improve action buttons UX [#15574]
  • Move deprecated logging into dedicated table/view [#15002]
  • Improve Button Styling in Modals [#15826]
  • Hide broken navigation in trees [#15746]
  • Add build assets to CI workflow [#15810]
  • Fix issues for plugins that pass around xPDOObjects [#15809]
  • Add template picker for creating new resources [#15535]
  • Hide user settings tab based on permissions [#15776]
  • Lazy load thumbnails in media browser [#15805]
  • Fix Tab Visibility in User Group Editing Panel [#15802]
  • Modernize manager template build workflow [#15793]
  • Fix image TV display via hash [#15775]
  • Prevent phpcs from failing on warnings [#15803]
  • Presume default patch level of 0 when not defined by package [#15791]
  • Improve field selection error for package provider [#15789]
  • Resolve S3 Media Source issues from Flysystem upgrade [#15786]
  • Refactor modTransportProvider using PSR-7 client [#15781]
  • Improve RTL styles [#15758]
  • Restore user password display [#15629]
  • Assorted modRest improvements [#15777]
  • Add PSR-7/17/18 HTTP services [#15779]
  • Avoid removing Element/GetClasses processor [#15780]
  • Add typeahead to Resource List TV [#15734]
  • Add missing user password validation characters [#15630]
  • Require auth token to access MODx.config to prevent XSSI [#15645]
  • Remove SQL Server support [#15761]
  • Skip session configuration check in CLI setup [#15769]
  • Decrease LOG_LEVEL for cache errors [#15753]
  • Upgrade flysystem to v2 [#15757]
  • Make naming consistent when duplicating user in grid [#15755]
  • Filter sensitive config values from placeholders [#15754]
  • Strip base_url only from beginning of relative url [#15751]
  • Update MODX logo in base template [#15750]
  • Change order of menu items for Context in tree [#15749]
  • Fix import section lexicons [#15747]
  • Fix displaying big SVG images in media browser [#15481]
  • Update minimum PHP version to 7.2
  • Change file creation behavior in media browser [#15654]
  • Support SameSite attribute in session cookies [#15669]
  • Set code of conduct for the repo [#15671]
  • Fix ignoring phpcs configuration file [#15668]
  • Fix the appearance of PHP notices on the dashboard page [#15650]
  • Fix issue when sending an internal message to the user [#15511]
  • Add return link to package management on a page of single package [#15612]
  • Switch non-index fields back to 255 char limit [#15398]
  • Add intermediate tablet breakpoint to improve view on small screens [#15259]
  • Improve language selector accessibility on the login page [#15627]
  • Add possibility to translate message about site unavailability [#15537]
  • Fix style of information messages in installer view [#15642]
  • Add clarity within creating folders in media sources [#15652]
  • Add endpoint property to S3 media source [#15641]
  • Add PHP Code Sniffer configuration file [#15640]
  • Fix filterPathSegment method call [#15638]
  • Rename Admin group to proper name of Access Policy Template Group [#15628]
  • Fix missed Developer Access Policy [#15626]
  • Fix permissions checking in modAccessibleObject objects [#15632]
  • Fix unavailable toggle language menu item because missed permission [#15621]
  • Fix link to the proper version in welcome dialog [#15613]
  • Update favicon in the installation folder [#15602]
  • Add the EXTR_REFS flag to the extract function [#15578]
  • Fix class key default value in the user creation form [#15620]
  • Add code quality GitHub Action [#15603]
  • Fallback to username when full name is missed in the Who is online widget [#15596]
  • Add an required attribute for admin creation fields during installation [#15601]
  • Fix MakeUrlTest->testSingleParameter test provider [#15594]
  • Remove deprecated modClassMap [#15079]
  • Fix context sub-menu not appearing in resource tree [#15593]
  • Fix the lexicon entries of upload_translit [#15600]
  • Fix trash page permission issues [#15482]
  • Hide dependent forms until items are not selected in trees [#15478]
  • Update base_help_url system settings with new link to documentation [#15572]
  • Change lexicon on update widget [#15591]
  • Simplify lexicons for grids [#15420]
  • Fix Add button style glitches in dashboards [#15599]
  • Add transliteration of files when uploading to a media source #modxbughunt [#15457]
  • Increase required php version to 7.1 [#15589]
  • Update information about the project in the readme file [#15562]
  • Implement isDirty function in MODx.panel.ImageTV [#15516]
  • Correct fields in the User / Account sections [#15539]
  • Change display styles for system information [#15554]
  • Remove TV with "list-multiple-legacy" type [#15489]
  • Translate descriptions for policies, policy templates and policy template groups [#14009]
  • Adjust class names in principal_targets system setting [#15529]
  • Fix preview thumbnail issue [#15526]
  • Fix image rotation in media browser [#15484]
  • Fix PHP notices on login page [#15456]
  • Adds missing lexicon file_folder_err_update [#15547]
  • Set controller property in config [#15552]
  • Change old class name to FCQN class_key for resources in tree [#15424]
  • Remove unnecessary type attribute in script tags [#15533]
  • Update logo and icon [#15444]
  • Add mail_smtp_autotls system setting [#15549]
  • Fix typo and change the name of upgrade scripts [#15548]
  • Adjust PR template to encourage using right format to connect issues [#15545]
  • Remove unnecessary type="text/javascript" [#15533]
  • Support properties for @CHUNK/@SNIPPET bindings [#15488]
  • Fix legacy class names [#15521]
  • Update editorconfig rules [#15520]
  • Replace 'modPlugin' with modPlugin::class in elementClassKey checks [#15519]
  • Decode URI of directory in quick create file [#15517]
  • Fix regular expression for file download [#15512]
  • Improve changelog display when installing extras [#15486]
  • Increase width of text TV input [#15485]
  • Import missing classes [#15477]
  • Fix loading package metadata for modx.transport [#15466]
  • Display name of elements in delete messages [#15463]
  • Fix PHP notices about undefined variables [#15459]
  • Remove http:// from empty weblink field on resource create form [#15422]
  • Update url in system setting base_help_url [#15411]
  • Fix HTTPS check on setup bootstrap [#15487]
  • Allow installation to work as expected behind a reverse proxy with HTTPS [#15470]
  • Improve behavior of blocking users [#15442]
  • Fix resource breadcrumbs if the resource is deleted [#15243]
  • Only log session info if session is initialized [#15308]
  • Improve removal of nested MODX tag content in sanitizeRequest [#15370]
  • Improve Navigation for Access Control Lists > User Groups & Users [#15159]
  • Various quick search improvements [#15158]
  • Improve layout of additional options for TV List Box (Single Select) type [#15150]
  • Remove allowNegative parameter for TV with number type [#15119]
  • Fix incorrect path setting when uploading files [#15227]
  • Add indication of selected file and expand active source in tree [#15228]
  • Display caption instead of description in template TV grid [#15231]
  • Make error_handler_class available as service [#15162]
  • UI improvements for site_name in header [#15180]
  • Changed "remove" to "delete", "update" to "edit" in lexicons [#15155]
  • Localize anonymous in context interface [#15153]
  • Fix drop animation appearing at the wrong position for dragged elements [#15111]
  • Resize static fields on statick checkbox toggle [#15100]
  • Change xtype to textarea for description in grids [#15126]
  • Change isfolder field in active resource [#15078]
  • Use 0 if id is undefined [#15102]
  • Set error message by field name instead of id [#15098]
  • Fix typeAhead parameter check [#15069]
  • Link to help localize MODX added to Help & Support [#15138]
  • Prevent path traversal when sending registry message [#15134]
  • Fix a second refresh of the grid when opening a combo box [#15123]
  • New lexicon for edit content type [#15094]
  • Fix resource drag & drop setting `is_folder` to mark parent as container [#15076]
  • Add numberfield as Field Type option for system settings [#15093]
  • Remember filter properties for system setting grid from browser url [#15086]
  • Prevent rewrite of .well-known directory used by LetsEncrypt [#15033]
  • Allow custom values in Listbox (Multi-Select) TV [#14957]
  • Fix DSN creation during an update with an existing port [#15083]
  • Clear phpThumb connector properties [#15068]
  • Date TV improvements [#15000]
  • Improve navigation styles in element tree [#14989]
  • Prevent overwriting apache_request_headers() in modRestServiceRequest [#15060]
  • Fix checkbox toggling for custom context paths in setup [#15008]
  • Remove references to safe_mode and related lexicons [#15058]
  • Fix nested output filters [#14458]
  • Add JSON Grid xtype [#14959]
  • Fix `allowedFileTypes` being ignored in the Media Browser [#15046]
  • Remove "allowBlank: false" for symlink/weblink in quick update [#14981]
  • Improve styles for login [#15018]
  • Add missing AddToGroup events in Security/Group/User/Create processor [#15022]
  • Use single-quotes in MySQL queries for modTransportPackage for ANSI_QUOTES compatibility [#15011]
  • Add context key to reload URL when switching templates [#14998]
  • Fix package dependency restrictions not working [#14904]
  • Fix fatal error when updating a git alpha1 install without running composer update [#14996]
  • Fix positioning of reset-to-default button on TVs [#14686]
  • Change style for uninstalled packages in the package manager [#14686]
  • Improve modal styling with more padding around buttons [#14978]
  • Fix resource drag & drop ordering [#14987]

At a glance

  • Released October 27, 2021 (5 years ago)
  • Major track MODX 3.x
  • % of sites 0% (0 sites)
  • Previous release MODX 3.0.0-alpha2 (6 years ago)
  • Newer release MODX 3.0.0-beta1 (5 years ago)

Source & compare

All MODX versions