How about Cliche and Modx phpthumb vulnerability

[valokammi]

Want to know is Cliche affected with Modx 2.6.4 phpthumb vulnerability?

[bYemma]

Yes it is. But if you update to MODX 2.6.5 the vulnerability is closed.

Markh's explanation:

modPhpThumb in core was patched in 2.6.5 to ensure only whitelisted properties could be used. Gallery did not use modPhpThumb but PhpThumb directly, also allowing any property, so that needed to be patched separately. Cliche uses modPhpThumb, so was patched with 2.6.5.