PT-2026-20514 · Majordomo · Majordomo

Valentin Lobstein · Published 2026-02-18 · Updated 2026-02-19 · CVE-2026-27178

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MajorDoMo versions (affected versions not specified)

Description The software contains a stored cross-site scripting (XSS) issue through method parameter injection into the shoutbox. The /objects/?method= API endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods, such as ThisComputer.VolumeLevelChanged(), pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. The dashboard widget auto-refreshes every 3 seconds, causing the injected script to execute automatically when an administrator loads the dashboard, potentially enabling session hijack through cookie exfiltration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27178

Affected Products

Majordomo

References · 6

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27178 · Security Note
• https://twitter.com/CVEnew/status/2024258082298351962 · Twitter Post
• https://vulncheck.com/advisories/majordomo-stored-cross-site-scripting-via-method-parameters-to-shoutbox · Note
• https://twitter.com/VulmonFeeds/status/2024325433831911688 · Twitter Post