CVE-2018-1000207: MODX Revolution phpthumb parameter filtering flaw allows arbitrary file creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high EPSS and public exploit references, but exploitation requires high privileges, keeping it below critical.

What it is

MODX Revolution 2.6.4 and earlier fails to properly filter user-supplied parameters before passing them into the phpthumb class, allowing an attacker to create files with a chosen filename and content. The flaw is an incorrect access control issue fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68. Because it enables writing attacker-controlled files on the server, it can lead to code execution or site compromise.

Impact

An attacker can write arbitrary files with attacker-chosen names and content to the server, which can be used to plant web shells or otherwise take over the application. The CVSS vector indicates high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via a web request to the phpthumb handling path; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N).

Exploitation

No CISA KEV listing, but EPSS is very high (0.64088, 99.188th percentile) and public references are tagged Exploit, indicating exploit code is publicly available.

What to do

• Upgrade MODX Revolution to a version containing commit 06bc94257408f6a575de20ddb955aca505ef6e68 or later.
• If immediate upgrade is not possible, restrict access to phpthumb endpoints to trusted authenticated users only.
• Review and harden permissions for accounts that can reach the affected functionality, since exploitation requires high privileges.
• Monitor and restrict write access to web-accessible directories to limit where created files can be placed.

Detection

• Monitor web server logs for requests to phpthumb endpoints with unusual or attacker-controlled filename parameters.
• Alert on creation of new files in web-accessible directories, especially files with script extensions.
• Compare file system contents against known-good baselines to detect unexpected files with custom names or content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.