CVE-2026-27602: Modoboa OS Command Injection Vulnerability
Summary
CVE-2026-27602: Modoboa has OS Command Injection. Affects modoboa versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Modoboa is an open-source mail hosting and management platform that provides a web-based interface for managing email accounts, domains, and related services. It is designed for ease of use and flexibility, allowing administrators to manage mail servers efficiently. However, a critical vulnerability has been identified that exposes the system to OS command injection attacks, particularly affecting users with Reseller or SuperAdmin privileges.
Vulnerability Detail
The vulnerability arises from the use of the 'exec_cmd()' function in the 'modoboa/lib/sysutils.py' file, which executes subprocess calls with 'shell=True'. This design flaw allows attackers to inject shell metacharacters into domain names, leading to arbitrary OS command execution on the server. For instance, if a domain name is crafted as '$(id>/tmp/proof).example.com', the shell executes the injected command before running the intended 'openssl' command. This vulnerability is present in multiple locations within the code, allowing for various attack vectors.
How To Fix
Latest published version: 2.11.1 as of 23 Oct 2026
pip install --upgrade "modoboa==2.11.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
pip install --upgrade "modoboa==2.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using special characters in domain names when creating new domains in Modoboa. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2026-27602 vulnerability in Modoboa poses a significant risk due to OS command injection capabilities. It is crucial for users with administrative access to update their installations to the patched version to safeguard against potential attacks. Regular monitoring and adherence to best practices can further enhance security.
See every vulnerability recorded for modoboa →
FAQ
An attacker with Reseller-level access can execute arbitrary OS commands on the mail server, potentially gaining root access.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Modoboa versions up to and including 2.7.0 are affected by this vulnerability.
Yes, the vulnerability has been patched in Modoboa version 2.7.1. It is recommended to upgrade to this version.
If an immediate upgrade is not possible, avoid using special characters in domain names to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for modoboa.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
