CVE-2026-27175

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

• CWE-78

• https://chocapikk.com/posts/2026/majordomo-revisited/Exploit, Third Party Advisory
• https://github.com/sergejey/majordomo/pull/1177Exploit, Issue Tracking
• https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-conditionThird Party Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2717The HTTP Headers plugin for WordPress is vulnerable to CRLF …5.5
• CVE-2026-27170OpenSift is an AI study tool that sifts through large datase…7.1
• CVE-2026-27171zlib before 1.3.2 allows CPU consumption via crc32_combine64…5.5
• CVE-2026-27172The ConsulRegistry in the camel-consul component (class org.…8.8
• CVE-2026-27173JWT tokens that were used by workers in Kubernetes Executors…8.7
• CVE-2026-27174MajorDoMo (aka Major Domestic Module) allows unauthenticated…9.8
• CVE-2026-27176MajorDoMo (aka Major Domestic Module) contains a reflected c…6.1
• CVE-2026-27177MajorDoMo (aka Major Domestic Module) contains a stored cros…6.1
• CVE-2026-27178MajorDoMo (aka Major Domestic Module) contains a stored cros…6.1
• CVE-2026-27179MajorDoMo (aka Major Domestic Module) contains an unauthenti…9.8
• CVE-2026-2718The Dealia – Request a Quote plugin for WordPress is vulnera…6.4
• CVE-2026-27180MajorDoMo (aka Major Domestic Module) is vulnerable to unaut…9.8