CVE-2022-26149: Modx Revolution

High severity, CVSS 7.2. EPSS: 9.3% chance of exploitation in the next 30 days.

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

Affected products

• Modx Revolution: up to and including 2.8.3

Published 2022-02-26. Last modified 2026-06-17.