sergejey MajorDoMo ?module=saverestore admin $_REQUEST code download

Summaryinfo

A vulnerability identified as problematic has been detected in sergejey MajorDoMo. This impacts the function admin of the file /objects/?module=saverestore. This manipulation of the argument $_REQUEST causes code download. This vulnerability appears as CVE-2026-27180. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in sergejey MajorDoMo (affected version not known). Affected by this vulnerability is the function admin of the file /objects/?module=saverestore. The manipulation of the argument $_REQUEST with an unknown input leads to a code download vulnerability. The CWE definition for the vulnerability is CWE-494. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

The weakness was presented by Valentin Lobstein. It is possible to read the advisory at chocapikk.com. This vulnerability is known as CVE-2026-27180 since 02/18/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1495 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• sergejey

Name

• MajorDoMo

Website

• Product: https://github.com/sergejey/majordomo/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion