Remote Code Execution Vulnerability in MajorDoMo by MajorDoMo Company

CVE-2026-27180

What is CVE-2026-27180?

MajorDoMo is susceptible to unauthenticated remote code execution due to a vulnerability that arises from supply chain compromise through update URL poisoning. The saverestore module facilitates access through its admin() method at the /objects/?module=saverestore endpoint without requiring authentication. This occurs because the system improperly handles requests, allowing an attacker to manipulate the system update URL via the auto_update_settings mode handler. They can then trigger the force_update handler, which fetches an Atom feed from a malicious URL, performs an insecure download, and executes arbitrary commands, including the installation of webshells, directly into the document root. This vulnerability highlights significant security risks associated with improper input validation and unprotected update mechanisms.

References