---
id: CVE-2026-27175
title: MajorDoMo Command Injection in rc/index.php via Race Condition
summary: >-
  MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS
  command injection via rc/index.php. The $param variable from user input is
  interpolated into a command string within double quotes without sanitization
  via escapes…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: sergejey
product: MajorDoMo
affected:
  - MajorDoMo <= *
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-02-26T16:20:08.943714Z'
exploitAvailable: true
published: '2026-02-18'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:37.827Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-27175'
references:
  - url: 'https://chocapikk.com/posts/2026/majordomo-revisited/'
    label: 'MajorDoMo Revisited: What I Missed in 2023'
  - url: 'https://github.com/sergejey/majordomo/pull/1177'
    label: 'Fix PR: sergejey/majordomo#1177'
  - url: >-
      https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition
    label: >-
      VulnCheck Advisory: MajorDoMo Command Injection in rc/index.php via Race
      Condition
tags:
  - cve.org
  - exploit-available
epss: 0.06904
epssPercentile: 0.94127
exploits:
  metasploit:
    - exploit/multi/http/majordomo_cmd_injection_rce
  checkedAt: '2026-11-08T14:51:57.351Z'
ingestedAt: '2026-11-08T14:51:22.467Z'
---

## Overview

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

## Affected

- `MajorDoMo <= *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.