MajorDoMo (version 0) suffers from a critical vulnerability (CVE-2026-27180) that allows unauthenticated remote code execution. The saverestore module exposes its admin() method at /objects/?module=saverestore without authentication due to improper use of gr('mode') reading directly from $_REQUEST. An attacker can poison the system update URL via the auto_update_settings handler and then trigger the force_update handler to start the update process. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS peer verification disabled, extracts it using a system tar command, and copies all extracted files to the web document root. This chain enables an attacker to deploy arbitrary PHP files, including webshells, with just two GET requests.

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely on the affected MajorDoMo system by deploying malicious PHP files to the webroot. This can lead to full system compromise, data theft, service disruption, or further network pivoting. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its high impact and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /objects/?module=saverestore endpoint and disable or restrict the auto-update functionality to prevent exploitation. Monitor for unusual update URL configurations and network activity related to update processes. Avoid exposing the vulnerable module to untrusted networks.