id: PYSEC-2026-2223
published: "2026-03-25T19:16:48.430Z"
modified: "2026-07-13T05:50:05.467891Z"
aliases:
- CVE-2026-27602
- GHSA-wwv8-cqpr-vx3m
details: Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.
affected:
- package:
    name: modoboa
    ecosystem: PyPI
    purl: pkg:pypi/modoboa
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.7.1
  versions:
  - 0.7.0
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.10.3
  - 1.10.4
  - 1.10.5
  - 1.10.6
  - 1.10.7
  - 1.11.0
  - 1.11.1
  - 1.12.0
  - 1.12.1
  - 1.12.2
  - 1.13.0
  - 1.13.1
  - 1.14.0
  - 1.15.0
  - 1.16.0
  - 1.16.1
  - 1.17.0
  - 1.2.0
  - 1.2.0-rc2
  - 1.2.1
  - 1.2.2
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.0.0b1
  - 2.0.0b2
  - 2.0.0b3
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.2.dev0
  - 2.1.3.dev0
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.3.0
  - 2.3.0b1
  - 2.3.0b2
  - 2.3.0b3
  - 2.3.0b4
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.3.6
  - 2.4.0
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.7.0
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/modoboa/modoboa/releases/tag/2.7.1
- type: FIX
  url: https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfa
- type: EVIDENCE
  url: https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3m
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H