XML External Entity vulnerability in MODX CMS

CRITICAL 9.1CVE-2020-25911 · BIT-modx-2020-25911 · GHSA-vhfp-9wvj-gwvg · Published 31/10/2021 · updated 17/06/2026

In short

CVE-2020-25911 is a CRITICAL (CVSS 9.1) vulnerability affecting modx/revolution, modx revolution (modx).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.9% of all vulnerabilities.
Fix: update to 2.8.0 or later.

Package	Affected versions	Patched versions
modx/revolution Packagist	`< 2.8.0`	`2.8.0`
modx revolution modx	`= 2.7.3`	No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

References

nvd.nist.gov/vuln/detail/CVE-2020-25911 · ADVISORY
modxcms/revolution · WEB
modxcms/revolution#15238 · WEB
modxcms/revolution#15238 · WEB
dahua966/Vul_disclose · WEB
modxcms/revolution · PACKAGE

More vulnerabilities in modx/revolution

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

modx/revolution

Packagist

< 2.8.0

2.8.0

modx revolution

modx

= 2.7.3

No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

More vulnerabilities in modx/revolution

See all →