CVE-2026-27175 describes an unauthenticated OS command injection vulnerability in MajorDoMo. The $param variable from user input is interpolated into a command string within double quotes without using escapeshellarg() or other sanitization. The unsafe command is stored in a database queue by safe_exec(), which does not sanitize input. The cycle_execs.php script, accessible without authentication, retrieves and executes these queued commands using exec(). An attacker can exploit a race condition by triggering cycle_execs.php to purge the queue and enter a polling loop, then inject a malicious command via the rc endpoint while the worker polls. Shell metacharacters expand inside double quotes, enabling remote code execution rapidly.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected MajorDoMo server. This can lead to full system compromise, data theft, or disruption of service. The vulnerability has a high CVSS 4.0 score of 9.2, reflecting its critical severity and ease of exploitation without privileges or user interaction.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, restrict access to the affected endpoints (rc/index.php and cycle_execs.php) through network controls or web application firewalls to prevent unauthenticated access. Avoid exposing these scripts to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.