Affected: modoboa

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.

Affected: PyPI: modoboa

### Summary

`exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server.

### Details

The root cause is in `modoboa/lib/sysutils.py:31`:

```python kwargs["shell"] = True process = subprocess.Popen(cmd, **kwargs) ```

When a create a domain is created with DKIM enabled, the domain name gets embedded into a shell command like this:

```python exec_cmd(f"openssl genrsa -out {dkim_storage_dir}/{domain.name}.pem {key_size}") ```

If the domain name contains something like `$(id>/tmp/proof).example.com`, the shell executes the injected command before running openssl.

The same pattern appears in several other places:

- `modoboa/admin/jobs.py:38` — mailbox rename via `mv` using `full_address` - `modoboa/amavis/lib.py:202` — `sa-learn` using `domain.name` - `modoboa/admin/models/mailbox.py:150` — `doveadm user` using `full_address` - `modoboa/maillog/graphics.py:105–107` — `rrdtool` using `domain.name` - `modoboa/webmail/models.py:54–57` — `doveadm move/delete` using `account.email`

### PoC

1. Deploy modoboa <= 2.7.0 2. Log in as a Reseller or SuperAdmin 3. Create a new domain named `$(id>/tmp/proof).example.com` with DKIM enabled 4. SSH into the server and read `/tmp/proof`

Something like this will be displayed:

``` uid=0(root) gid=0(root) grou…