CVE-2026-27602 Modoboa has an OS Command Injection

High 7.2 Published 25 Mar 2026 Updated 26 Mar 2026

Attackers with Reseller or SuperAdmin privileges can execute arbitrary OS commands by injecting shell metacharacters into domain names.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-27602?

CVE-2026-27602 is a high-severity command injection vulnerability in modoboa, published on 25 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.

Weakness: CWE-78

Which versions are affected by CVE-2026-27602?

3 open source packages ship an affected version, including modoboa. It affects 1 product.

Package	Affected	Fixed in
`modoboa` PyPI	All versions	`2.7.1`
`modoboa` PyPI	All versions	`2.7.1`
`modoboa` PyPI	All versions	`2.7.1`

Products include Modoboa Modoboa.

How do I fix CVE-2026-27602?

Upgrade modoboa to 2.7.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-27602 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27602 exists.

Sources

Also known as GHSA-wwv8-cqpr-vx3m, PYSEC-2026-2223.