PT-2026-20511 · Majordomo · Majordomo

Valentin Lobstein · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-27175

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MajorDoMo versions (affected versions not specified)

Description MajorDoMo is susceptible to unauthenticated OS command injection through the ‘rc/index.php’ component. The $param variable, sourced from user input, is incorporated into a command string within double quotes without proper sanitization using escapeshellarg(). This command is then placed in a database queue by the safe exec() function, which does not perform any sanitization. The cycle execs.php script, accessible via the web without authentication, retrieves commands from the queue and executes them directly using exec(). An attacker can exploit a race condition by triggering cycle execs.php to clear the queue and initiate a polling loop, then injecting a malicious command through the ‘rc’ endpoint while the worker is polling. This allows for remote code execution due to the expansion of shell metacharacters within double quotes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27175

Affected Products

Majordomo

References · 5

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27175 · Security Note
• https://twitter.com/CVEnew/status/2024258084978504180 · Twitter Post
• https://vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition · Note