In MODX Revolution prior to 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
modx modx revolution