CVE-2026-27602: Modoboa

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.

Affected products

• Modoboa Modoboa: before 2.7.1 (fixed in 2.7.1)

Published 2026-03-25. Last modified 2026-06-17.