{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27175", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-18T15:22:30.053Z", "datePublished": "2026-02-18T21:10:36.987Z", "dateUpdated": "2026-03-05T01:31:11.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-05T01:31:11.056Z"}, "datePublic": "2026-02-17T00:00:00.000Z", "title": "MajorDoMo Command Injection in rc/index.php via Race Condition", "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "sergejey", "product": "MajorDoMo", "versions": [{"version": "0", "lessThanOrEqual": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://chocapikk.com/posts/2026/majordomo-revisited/", "name": "MajorDoMo Revisited: What I Missed in 2023", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sergejey/majordomo/pull/1177", "name": "Fix PR: sergejey/majordomo#1177", "tags": ["patch"]}, {"name": "VulnCheck Advisory: MajorDoMo Command Injection in rc/index.php via Race Condition", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition"}], "credits": [{"lang": "en", "value": "Valentin Lobstein", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T16:20:08.943714Z", "id": "CVE-2026-27175", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:20:26.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27175", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T16:20:08.943714Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:20:15.545Z"}}], "cna": {"title": "MajorDoMo Command Injection in rc/index.php via Race Condition", "credits": [{"lang": "en", "type": "finder", "value": "Valentin Lobstein"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sergejey", "product": "MajorDoMo", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-17T00:00:00.000Z", "references": [{"url": "https://chocapikk.com/posts/2026/majordomo-revisited/", "name": "MajorDoMo Revisited: What I Missed in 2023", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sergejey/majordomo/pull/1177", "name": "Fix PR: sergejey/majordomo#1177", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition", "name": "VulnCheck Advisory: MajorDoMo Command Injection in rc/index.php via Race Condition", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-05T01:31:11.056Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27175", "state": "PUBLISHED", "dateUpdated": "2026-03-05T01:31:11.056Z", "dateReserved": "2026-02-18T15:22:30.053Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-18T21:10:36.987Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*", "matchCriteriaId": "7008978E-8DE1-4811-958F-3AFB3847B919", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second."}, {"lang": "es", "value": "MajorDoMo (tambi\u00e9n conocido como Major Domestic Module) es vulnerable a la inyecci\u00f3n de comandos del sistema operativo no autenticada a trav\u00e9s de rc/index.php. La variable $param de la entrada del usuario se intercala en una cadena de comandos entre comillas dobles sin saneamiento a trav\u00e9s de escapeshellarg(). El comando se inserta en una cola de la base de datos por safe_exec(), que no realiza ning\u00fan saneamiento. El script cycle_execs.php, que es accesible por la web sin autenticaci\u00f3n, recupera los comandos en cola y los pasa directamente a exec(). Un atacante puede explotar una condici\u00f3n de carrera activando primero cycle_execs.php (que purga la cola y entra en un bucle de sondeo), luego inyectando un comando malicioso a trav\u00e9s del punto final rc mientras el trabajador est\u00e1 sondeando. Los metacaracteres de shell inyectados se expanden dentro de las comillas dobles, logrando la ejecuci\u00f3n remota de c\u00f3digo en un segundo."}], "id": "CVE-2026-27175", "lastModified": "2026-02-20T20:02:13.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-02-18T22:16:25.263", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory", "Exploit"], "url": "https://chocapikk.com/posts/2026/majordomo-revisited/"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Exploit"], "url": "https://github.com/sergejey/majordomo/pull/1177"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MajorDoMo", "source": "cna", "vendor": "sergejey"}, "product": "majordomo", "vendor": "sergejey"}], "analysis": {"en": {"generated_at": "2026-04-16T17:06:23.074914+00:00", "value": {"mitigation_remediation": ["Update to the patched release that removes the unsafe command injection path (apply the merge in PR #1177).", "Disable or restrict access to cycle_execs.php so that only authenticated users or no users can invoke it, or remove the script entirely if it is not required.", "If an immediate patch cannot be applied, sanitize or escape $param (for example, by using escapeshellarg) before interpolating it into the command string."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of MajorDoMo maintained by sergejey. No explicit version range is listed, so all releases that contain the vulnerable implementation of rc/index.php and cycle_execs.php are potentially affected.", "description_and_impact": "The vulnerability allows an unauthenticated attacker to inject operating\u2011system commands through the rc/index.php endpoint. User supplied data is interpolated into a shell command string inside double quotes without escaping, and the command is subsequently executed by the cycle_execs.php script. This race condition enables the attacker to trigger arbitrary code execution on the host in less than one second. The weakness involved is command injection (CWE\u201178), which compromises confidentiality, integrity, and availability of the affected system.", "risk_and_exploitability": "The CVSS score of 9.2 indicates critical severity; the EPSS score of 25% reflects a moderate probability of exploitation in the near term, and the vulnerability is not yet catalogued in the CISA KEV list. The attack vector is network-based, requiring only HTTP access to the web interface; authentication is not required. Exploitation is performed by first invoking cycle_execs.php to start the command queue, then immediately sending the malicious input to rc/index.php so that the queued command is executed during the polling loop. The ability to run arbitrary commands in the context of the web server indicates a full remote code execution scenario."}}}}, "created": "2026-02-19T10:11:04.683794+00:00", "updated": "2026-04-16T17:15:17.980741+00:00", "vendors": ["sergejey", "sergejey$PRODUCT$majordomo"]}