sergejey MajorDoMo rc/index.php escapeshellarg param os command injection

Summaryinfo

A vulnerability marked as critical has been reported in sergejey MajorDoMo. Affected by this vulnerability is the function escapeshellarg of the file rc/index.php. Performing a manipulation of the argument param results in os command injection. This vulnerability is known as CVE-2026-27175. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in sergejey MajorDoMo (the affected version is unknown). This affects the function escapeshellarg of the file rc/index.php. The manipulation of the argument param with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

The weakness was published by Valentin Lobstein. The advisory is shared at chocapikk.com. This vulnerability is uniquely identified as CVE-2026-27175 since 02/18/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

By approaching the search of inurl:rc/index.php it is possible to find vulnerable targets with Google Hacking.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• sergejey

Name

• MajorDoMo

Website

• Product: https://github.com/sergejey/majordomo/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion