https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:22:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-27602 <p><strong>Affected:</strong> modoboa</p> <p>Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.</p> <p><strong>Affected:</strong> modoboa</p> <p>Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-27602 https://cve.radiocsirt.org/vuln/ghsa-wwv8-cqpr-vx3m <p><strong>Affected:</strong> PyPI: modoboa</p> <p>### Summary</p> <p>`exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server.</p> <p>### Details</p> <p>The root cause is in `modoboa/lib/sysutils.py:31`:</p> <p>```python kwargs[&#34;shell&#34;] = True process = subprocess.Popen(cmd, **kwargs) ```</p> <p>When a create a domain is created with DKIM enabled, the domain name gets embedded into a shell command like this:</p> <p>```python exec_cmd(f&#34;openssl genrsa -out {dkim_storage_dir}/{domain.name}.pem {key_size}&#34;) ```</p> <p>If the domain name contains something like `$(id&gt;/tmp/proof).example.com`, the shell executes the injected command before running openssl.</p> <p>The same pattern appears in several other places:</p> <p>- `modoboa/admin/jobs.py:38` — mailbox rename via `mv` using `full_address` - `modoboa/amavis/lib.py:202` — `sa-learn` using `domain.name` - `modoboa/admin/models/mailbox.py:150` — `doveadm user` using `full_address` - `modoboa/maillog/graphics.py:105–107` — `rrdtool` using `domain.name` - `modoboa/webmail/models.py:54–57` — `doveadm move/delete` using `account.email`</p> <p>### PoC</p> <p>1. Deploy modoboa &lt;= 2.7.0 2. Log in as a Reseller or SuperAdmin 3. Create a new domain named `$(id&gt;/tmp/proof).example.com` with DKIM enabled 4. SSH into the server and read `/tmp/proof`</p> <p>Something like this will be displayed:</p> <p>``` uid=0(root) gid=0(root) grou…</p> <p><strong>Affected:</strong> PyPI: modoboa</p> <p>### Summary</p> <p>`exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server.</p> <p>### Details</p> <p>The root cause is in `modoboa/lib/sysutils.py:31`:</p> <p>```python kwargs[&#34;shell&#34;] = True process = subprocess.Popen(cmd, **kwargs) ```</p> <p>When a create a domain is created with DKIM enabled, the domain name gets embedded into a shell command like this:</p> <p>```python exec_cmd(f&#34;openssl genrsa -out {dkim_storage_dir}/{domain.name}.pem {key_size}&#34;) ```</p> <p>If the domain name contains something like `$(id&gt;/tmp/proof).example.com`, the shell executes the injected command before running openssl.</p> <p>The same pattern appears in several other places:</p> <p>- `modoboa/admin/jobs.py:38` — mailbox rename via `mv` using `full_address` - `modoboa/amavis/lib.py:202` — `sa-learn` using `domain.name` - `modoboa/admin/models/mailbox.py:150` — `doveadm user` using `full_address` - `modoboa/maillog/graphics.py:105–107` — `rrdtool` using `domain.name` - `modoboa/webmail/models.py:54–57` — `doveadm move/delete` using `account.email`</p> <p>### PoC</p> <p>1. Deploy modoboa &lt;= 2.7.0 2. Log in as a Reseller or SuperAdmin 3. Create a new domain named `$(id&gt;/tmp/proof).example.com` with DKIM enabled 4. SSH into the server and read `/tmp/proof`</p> <p>Something like this will be displayed:</p> <p>``` uid=0(root) gid=0(root) grou…</p> https://cve.radiocsirt.org/vuln/ghsa-wwv8-cqpr-vx3m