{"id":"CVE-2026-27175","title":"MajorDoMo Command Injection in rc/index.php via Race Condition","summary":"MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapes…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"sergejey","product":"MajorDoMo","affected":["MajorDoMo <= *"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-02-26T16:20:08.943714Z"},"exploitAvailable":true,"published":"2026-02-18","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:01:37.827Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27175","references":[{"url":"https://chocapikk.com/posts/2026/majordomo-revisited/","label":"MajorDoMo Revisited: What I Missed in 2023"},{"url":"https://github.com/sergejey/majordomo/pull/1177","label":"Fix PR: sergejey/majordomo#1177"},{"url":"https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition","label":"VulnCheck Advisory: MajorDoMo Command Injection in rc/index.php via Race Condition"}],"tags":["cve.org","exploit-available"],"epss":0.06904,"epssPercentile":0.94127,"exploits":{"metasploit":["exploit/multi/http/majordomo_cmd_injection_rce"],"checkedAt":"2026-11-08T14:51:57.351Z"},"ingestedAt":"2026-11-08T14:51:22.467Z","slug":"CVE-2026-27175","body":"## Overview\n\nMajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.\n\n## Affected\n\n- `MajorDoMo <= *`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":1.4,"exploitation":12,"ransomware":0},"changes":[]}