CVE-2026-27174 MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

Critical 9.3 Published 18 Feb 2026 Updated 23 Jun 2026

Unauthenticated attackers can execute arbitrary PHP code via the admin console due to missing authentication checks and unsafe eval usage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-27174?

CVE-2026-27174 is a critical code injection vulnerability in sergejey MajorDoMo, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Weakness: CWE-94

Which versions are affected by CVE-2026-27174?

It affects 1 product.

Products include Mjdm Majordomo.

How do I fix CVE-2026-27174?

No fix has been published for CVE-2026-27174 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-27174 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27174 exists.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-8p47-wg5j-hm56.