1 post - 1 participant

Read full topic

1 post - 1 participant

Read full topic

• Project: MODX Revolution (core)
• CVE ID: Pending
• Affected Versions: All versions
• Fixed Version: 3.2.3 and 2.8.9
• Release Date: 2026-07-21
• Severity: Pending—impact varies by site configuration. A formal CVSS score will be published with the full technical disclosure.

Vulnerability Details

Type

Improper Input Validation, with potential escalation to Remote Code Execution

Description

A vulnerability has been identified in MODX Revolution related to insufficient input validation. On its own, this can allow injection of arbitrary content into site templates. Depending on site-specific factors, impact can escalate further, up to and including remote code execution. The issue has been present for an extended period and was identified during an internal security review.

We are withholding further technical detail—including attack vector, affected configuration criteria, and proof-of-concept information—until patch adoption is broad enough for fuller disclosure to be responsible. A follow-up advisory with complete technical details will be published at that time.

Attack Vector

Not published in this preliminary advisory.

Affected Systems

Some installations are affected more directly than others depending on configuration. We are not publishing the specific criteria at this time. All MODX Revolution installations on the 2.8.x and 3.x branches should upgrade regardless of known configuration, since exposure can’t be reliably self-assessed without the full technical detail.

Mitigation

Upgrade required: Upgrade to 3.2.3 or 2.8.9 as soon as possible.

MODX Cloud customers: infrastructure-level mitigations have been applied. This reduces risk while you upgrade but doesn’t replace patching your site.

Credits

• Discovery: Elizabeth Southwell (Omeryl)
• Resolution: Jason Coward (opengeek)
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2026-07-20
• Fix Development: 2026-07-21
• Preliminary Disclosure: 2026-07-21
• Full Technical Disclosure: To be announced

References

• MODX Security Team Contact: security@modx.com
• Fixed Version Downloads: Revolution 3.2.3, Revolution 2.8.9

Revision History

• 2026-07-21: Preliminary advisory published. Full technical disclosure to follow once patch adoption is sufficient.

1 post - 1 participant

Read full topic

• Read the Complete Release Announcement
• Download Revolution 3.2.3
• Download Revolution 2.8.9

1 post - 1 participant

Read full topic

1 post - 1 participant

Read full topic

• Read the Complete Release Announcement
• Download Revolution 3.2.2
• Create a Revo 3.2.2 Cloud

1 post - 1 participant

Read full topic

1 post - 1 participant

Read full topic

• Read the Complete Release Announcement
• Download Revolution 3.2.1
• Create a Revo 3.2.1 Cloud

1 post - 1 participant

Read full topic

This release brings stability improvements and refinements that enhance your content management workflow. From mobile-friendly manager updates to enhanced Template Variable rendering, improved security features to PHP 8.5 compatibility, version 3.2 represents our ongoing commitment to refining and polishing the MODX platform.

Important: This release requires PHP 8.1 or higher. Please verify your server meets this requirement before upgrading.

• Read the Complete Release Announcement
• Download Revolution 3.2.0
• Create a Revo 3.2.0 Cloud

1 post - 1 participant

Read full topic

Revo 3.1.1 brings a fresh collection of improvements to enhance system stability and user experience, and represents our ongoing commitment to refining and polishing the MODX platform.

• Read the Complete Release Announcement
• Download Revolution 3.1.1
• Create a Revo 3.1.1 Cloud

modAi also debuted this week, representing MODX’s foray into the brave new world of generative AI. What began as a simple proof of concept rapidly went through a “bit” of feature creep and turned into something truly powerful, useful, and—in the long history of all things MODX—highly configurable: modAI 0.9.0-beta | MODX

TL;DR: modAI supports mixing and matching models (Claude, ChatGPT, Gemini, and custom AI gateways like Open WebUI), attaches to any text/textarea/image field in the Manager, and can have canned or freeform prompts to help you generate text, images, and alt tags faster than ever before. It also works with Image+ and SEO Suite, so you can finally nail crucial SEO content faster than ever before. All you need is an API key and a few good prompts.

If you have yet to explore MODX Revolution 3.x, then these two releases are an awesome place to start.

1 post - 1 participant

Read full topic

It brings a fresh collection of improvements to enhance system stability and user experience. From resolving the upgrade version display in the Manager to fixing thumbnail challenges with complex filenames, PHP 8.4 compatibility to updated Lexicons, version 3.0.6 represents our ongoing commitment to refining and polishing the MODX platform.

• Read the Complete Release Announcement
• Download Revolution 3.0.6
• Create a Revo 3.0.6 Cloud

1 post - 1 participant

Read full topic

• Project: Login Extra
• CVE ID: CVE-2024-55039 (pending)
• Affected Versions: 1.5.2 through 1.9.13
• Fixed Version: 1.9.14
• Release Date: 2024-11-22
• Severity: Critical
• CVSS v4.0 Score: 9.4
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Details

Type

Remote Code Execution (RCE) via PHP Object Injection

Description

A critical vulnerability has been identified in the MODX Login Extra that allows arbitrary PHP code execution through PHP Object Injection. The vulnerability stems from unsafe deserialization of user-supplied data using PHP’s unserialize() function without proper sanitization.

Attack Vector

An authenticated user, regardless of their permission level, can exploit this vulnerability by submitting specially crafted data through the Login form. The vulnerability can be triggered when:

1. The system processes user input through the Login form
2. The malicious payload is passed to the unsafe unserialize() function
3. The resulting PHP object injection leads to arbitrary code execution

Affected Systems

The vulnerability affects MODX Revolution installations that meet ALL of the following criteria:

1. Have the Login Extra installed (versions 1.5.2 to 1.9.13)
2. Have a web-accessible login form using the Login Extra
3. Allow user authentication

Note: Systems with Registration forms using the Login Extra may be particularly vulnerable if user validation is not required.

Mitigation

Immediate Update Required: Upgrade Login Extra to version 1.9.14 or later using the MODX Extras Installer in your MODX Revolution Projects.

Technical Details

The vulnerability exists due to:

• Unsafe usage of PHP’s unserialize() function
• Lack of input validation before deserialization
• Insufficient permission checking in the login process

Credits

• Discovery: Drew Webber
• Resolution: Thomas Jakobi and John Peca
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2024-11-22
• Fix Development: 2024-11-22
• Public Disclosure: 2024-11-22

References

• MODX Security Team Contact: Security Team
• Fixed Version Download: Login 1.9.14

Revision History

• 2024-11-22: Initial advisory publication

1 post - 1 participant

Read full topic

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

• Read the Complete Release Announcement
• Download Revolution 2.8.8
• Create a Revo 2.8.8 Cloud

1 post - 1 participant

Read full topic

This release includes some quality of life and user interface improvements for site managers and developers including a fix for the datepicker on Resources created in Revo 2.x, the addition of the displaying the username on the confirmation screen of a password change, as well as many more under-the-hood performance and operational improvements and fixes.

• Read the Complete Release Announcement
• Download Revolution 3.0.5
• Create a Revo 3.0.5 Cloud

1 post - 1 participant

Read full topic

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

• Read the Complete Release Announcement
• Download Revolution 2.8.7
• Create a Revo 2.8.7 Cloud

1 post - 1 participant

Read full topic

This release improves user and developer experience, augments security, cleans up many legacy code issues, updates key dependencies used in MODX Revolution, and resolves numerous minor bugs.

• Read the Release Announcement
• Download MODX Revolution 3.0.4
• Create a Revo 3.0.4 Website in MODX Cloud

1 post - 1 participant

Read full topic

If you’re a fan of safer websites, and fewer PHP errors and warnings with modern PHP, then this is a great release for you. It improves security, improves PHP 8.x compatibility, updates phpThumb and Smarty (key libraries used in MODX Revolution), and addresses various minor bug fixes.

• Read the Complete Release Announcement
• Download Revolution 2.8.6
• Create a Revo 2.8.6 Cloud

1 post - 1 participant

Read full topic

• logins to the forum
• new user registrations
• submitting or editing Extras listings,
• changes to user profiles and passwords, and
• submitting Contributor License Agreements (CLA).

We’re taking these steps to modernize the back-end systems, to improve performance and functionality, and to allow adding new features to Extras and the broader community user management infrastructure.

This maintenance operation will not impact MODX Cloud or searching and downloading Extras in MODX installations.

The maintenance window is estimated to be no longer than 6 hours. If you’d like to follow the progress of and be notified of the completion, you may wish to subscribe to the scheduled maintenance notice on our Status Page.

1 post - 2 participants

Read full topic

• new user registrations
• submitting or editing Extras listings,
• changes to user profiles and passwords, and
• submitting Contributor License Agreements (CLA).

We’re taking these steps to modernize the back-end systems, to improve performance and functionality, and to allow adding new features to Extras and the broader community user management infrastructure.

This maintenance operation will not impact MODX Cloud or searching and downloading Extras in MODX installations.

The maintenance window is estimated to be no longer than 6 hours. If you’d like to follow the progress of and be notified of the completion, you may wish to subscribe to the scheduled maintenance notice on our Status Page.

1 post - 1 participant

Read full topic

• Read the Complete Release Announcement
• Download Revolution 2.8.5
• Create a Revo 2.8.5 Cloud

1 post - 1 participant

Read full topic

An important reminder about upgrading to Revo 3: we strongly urge you to carefully read the upgrade guide before making the leap—there are many significant changes under the hood and a few of your favorite Extras may not yet be fully compatible. You should test upgrades on a clone of your site, first, when upgrading from our older 2.x branch.

Before upgrading from Revo 2.x to 3.0.3, please review the upgrade guide.

• Read the Complete Revo 3.0.3 Release Announcement
• Download Revo 3.0.3
• Create a new Revo 3.0.3 Cloud

1 post - 1 participant

Read full topic

An important reminder about upgrading to Revo 3: we strongly urge you to carefully read the upgrade guide before making the leap—there are many significant changes under the hood and a few of your favorite Extras may not yet be fully compatible. You should test upgrades on a clone of your site, first, when upgrading from our older 2.x branch.

Before upgrading from Revo 2.x to 3.0.2, please review the upgrade guide.

• Read the Complete Revo 3.0.2 Release Announcement
• Download Revo 3.0.2
• Create a new Revo 3.0.2 Cloud

1 post - 1 participant

Read full topic

https://tickets.modmore.com/video-tickets/

As an added bonus, we’re giving all in-person or online ticket purchasers 50% off a new MODX Cloud Base plan for a year, or for existing users, a free year of CDN/WAF for any site that doesn’t already have one … a savings of $180-240—so hurry and get your tickets while you can!

1 post - 1 participant

Read full topic

Revo 3.0.1

While our initial release of MODX Revolution 3.0 has proven to be one of our best releases ever, there were some areas that needed attention. With that in mind, our first patch release is here, just under a month after its initial debut.

Before upgrading from Revo 2.x to 3.0.1, please review the upgrade guide.

• Read the Complete Revo 3.0.1 Release Announcement
• Download Revo 3.0.1
• Create a new Revo 3.0.1 Cloud

Revo 2.8.4

This 2.8.4 release focuses on a few bugs, updates dependencies, and improves compatibility with newer versions of PHP. All users of the 2.8.3 and earlier should upgrade to this release if you are not ready to upgrade to MODX Revolution 3.0.1, just yet.

• Read the Complete Revo 2.8.4 Release Announcement
• Download Revo 2.8.4
• Create a new Revo 2.8.4 Cloud

Need Help Upgrading?

If you’re not sure how to upgrade but would like to get your site onto the latest version of MODX Revolution, check out the MODX Garage and Speed Shop to contact the MODX team for expert assistance. We can advise you of your options.

1 post - 1 participant

Read full topic

MODX Revolution is a major update that delivers a new Manager with big UX improvements, modernizes the codebase by adopting modern coding practices including leveraging Composer and provides the foundation for the next innovations in the CMS space.

If you are a growing organization that wants the fastest, most secure, and most flexible platform for your online presence, then you need to look no further than MODX Revolution 3.0.

• Read the full release blog
• Learn about upgrading to MODX Revolution 3.0
• Download MODX Revolution 3.0

1 post - 1 participant

Read full topic