PT-2026-20511 · Majordomo · Majordomo

Valentin Lobstein · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-27175

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MajorDoMo versions (affected versions not specified)

Description MajorDoMo is susceptible to unauthenticated OS command injection through the ‘rc/index.php’ component. The $param variable, sourced from user input, is incorporated into a command string within double quotes without proper sanitization using escapeshellarg(). This command is then placed in a database queue by the safe exec() function, which does not perform any sanitization. The cycle execs.php script, accessible via the web without authentication, retrieves commands from the queue and executes them directly using exec(). An attacker can exploit a race condition by triggering cycle execs.php to clear the queue and initiate a polling loop, then injecting a malicious command through the ‘rc’ endpoint while the worker is polling. This allows for remote code execution due to the expansion of shell metacharacters within double quotes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-27175

Produtos afetados

Majordomo

Referências · 5

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27175 · Nota de Segurança
• https://twitter.com/CVEnew/status/2024258084978504180 · Publicação no Twitter
• https://vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition · Nota