PT-2026-20510 · Majordomo · Majordomo

Valentin Lobstein · Published 2026-02-18 · Updated 2026-05-07 · CVE-2026-27174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MajorDoMo (affected versions not specified)

Description Unauthenticated remote code execution is possible via the admin panel's PHP console feature. An include order bug in modules/panel.class.php allows execution to continue past a redirect() call that lacks an exit statement, enabling unauthenticated requests to reach the ajax handler in inc panel ajax.php. The console handler in that file passes user-supplied input from GET parameters (via register globals) directly to the eval() function without authentication checks. An attacker can execute arbitrary PHP code by sending a crafted GET request to the '/admin.php' endpoint using the ajax panel, op, and command parameters. Real-world exploitation has been observed using php/meterpreter/reverse tcp payloads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-27174

Affected Products

Majordomo

References · 8

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27174 · Security Note
• https://vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval · Note
• https://twitter.com/Junior_Baines/status/2046237551657099377 · Twitter Post
• https://twitter.com/autumn_good_35/status/2052349629560455357 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2046514306481852741 · Twitter Post
• https://twitter.com/dailytechonx/status/2052412158894354492 · Twitter Post