dbcve.org
MajordomoApplication · Mjdm

CVE-2026-27175

CRITICAL · 9.8 CVSS v3.1 Published 2026-02-18
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
100/100
Remediation priority · Urgent
Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

MajorDoMo's rc/index.php accepts user input via the $param variable which gets inserted into a shell command string within double quotes without sanitization. This payload enters a database queue via safe_exec(), and the web-accessible cycle_execs.php script retrieves and executes queued commands through exec() without validation. A race condition allows attackers to inject commands during the polling window, achieving unauthenticated RCE within one second.

MitigationApply escapeshellarg() to all user input before command interpolation, add authentication to cycle_execs.php, and refactor safe_exec() to avoid unsafe exec() calls with unvalidated data.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
MajordomoApplication
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm MajorDoMo installation
    Look for the MajorDoMo web directory (typically in /var/www/, /opt/, or the web root). Check for rc/index.php and cycle_execs.php files in the web-accessible directory.
    Affected if The MajorDoMo application files rc/index.php and cycle_execs.php exist in the web directory.
  2. Examine rc/index.php for vulnerable $param usage
    Open rc/index.php and search for code that uses the $param variable within shell command strings, particularly inside double quotes without escapeshellarg() or similar sanitization.
    Affected if The $param variable is directly interpolated into a shell command string enclosed in double quotes without input sanitization.
  3. Verify safe_exec() function implementation
    Locate the safe_exec() function definition (commonly in includes/ or functions/ directory) and examine whether it passes unsanitized data to exec() or system() calls.
    Affected if safe_exec() internally uses exec() or system() with data that has not been sanitized with escapeshellarg().
  4. Check cycle_execs.php for unauthenticated command execution
    Open cycle_execs.php and verify that it retrieves commands from the database queue and passes them to exec() without validating the source or sanitizing the input.
    Affected if cycle_execs.php executes queued commands via exec() without authentication or input validation.
  5. Determine web accessibility of vulnerable endpoints
    Check if rc/index.php and cycle_execs.php are accessible over HTTP/HTTPS without authentication requirements.
    Affected if The web interface (rc/index.php and cycle_execs.php) is accessible without authentication, allowing external attackers to inject commands through the queue.

If MajorDoMo is installed with web-accessible rc/index.php and cycle_excs.php files containing the described vulnerable code patterns, the environment is affected by CVE-2026-27175 and vulnerable to unauthenticated RCE.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch github.com →
Interim mitigation

Apply escapeshellarg() to all user input before command interpolation, add authentication to cycle_execs.php, and refactor safe_exec() to avoid unsafe exec() calls with unvalidated data.

Recommended fix High confidence
  1. 1. Access the vendor patch at https://github.com/sergejey/majordomo/pull/1177 to review the code changes
  2. 2. Locate the rc/index.php file in the MajorDoMo installation
  3. 3. Identify where the $param variable is interpolated into command strings (within double quotes)
  4. 4. Apply the fix by wrapping the $param variable with escapeshellarg() before inserting into the command string
  5. 5. Alternatively, refactor the code to avoid double-quote interpolation of user input into shell commands entirely
  6. 6. Ensure cycle_execs.php is not directly web-accessible - restrict access via web server configuration (authentication or IP allowlisting)
  7. 7. Verify the safe_exec() function performs proper input sanitization or remove its use for untrusted input
  8. 8. Test the fix by attempting to inject shell metacharacters via the rc endpoint

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Majordomo Scoped from the published advisory
  • Consultation4.0 h
  • Implementation16.0 h
  • Testing8.0 h
  • Review / QA4.0 h
32.0 hours of engineering $5,600
Get the patch applied

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,960.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-27175 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-27175 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data