PT-2026-28089 · Modoboa · Modoboa

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-27602

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modoboa versions prior to 2.7.1

Description Modoboa is a mail hosting and management platform. The exec cmd() function in modoboa/lib/sysutils.py consistently executes subprocess calls with shell=True. Because domain names are directly incorporated into shell command strings without proper sanitization, a Reseller or SuperAdmin can inject shell metacharacters into a domain name to execute arbitrary operating system commands on the server. Specifically, the issue resides in modoboa/lib/sysutils.py:31. The vulnerability is present in several areas, including domain creation with DKIM enabled, mailbox renaming, sa-learn execution, doveadm user commands, rrdtool usage, and doveadm move/delete operations. An attacker with Reseller-level access or higher can potentially execute arbitrary OS commands as root on the mail server.

Recommendations Modoboa versions prior to 2.7.1 should be updated to version 2.7.1 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27602

GHSA-WWV8-CQPR-VX3M

Affected Products

Modoboa

References · 10

• 🔥 https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27602.json · Exploit
• https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27602 · Security Note
• https://osv.dev/vulnerability/GHSA-wwv8-cqpr-vx3m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27602 · Vendor Advisory
• https://github.com/modoboa/modoboa/releases/tag/2.7.1 · Note
• https://github.com/modoboa/modoboa · Note
• https://twitter.com/CVEnew/status/2036911807462613023 · Twitter Post
• https://twitter.com/cyberbivash/status/2036908645410062563 · Twitter Post