CVE-2026-27602

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.

• CWE-78

• https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfaPatch
• https://github.com/modoboa/modoboa/releases/tag/2.7.1Product, Release Notes
• https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3mExploit, Vendor Advisory
• https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3mExploit, Vendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27597Enclave is a secure JavaScript sandbox designed for safe AI …10
• CVE-2026-27598Dagu is a workflow engine with a built-in Web user interface…6.5
• CVE-2026-27599CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2
• CVE-2026-2760Sandbox escape due to incorrect boundary conditions in the G…10
• CVE-2026-27600HomeBox is a home inventory and organization system. Prior t…4.3
• CVE-2026-27601Underscore.js is a utility-belt library for JavaScript. Prio…5.9
• CVE-2026-27603Chartbrew is an open-source web application that can connect…7.5
• CVE-2026-27604FOSSBilling is a free, open-source billing and client manage…10
• CVE-2026-27605Chartbrew is an open-source web application that can connect…5.4
• CVE-2026-27606Rollup is a module bundler for JavaScript. Versions prior to…9.8
• CVE-2026-27607RustFS is a distributed object storage system built in Rust.…9.1
• CVE-2026-27608Parse Dashboard is a standalone dashboard for managing Parse…8.1