CVE-2026-27602: Modoboa has an OS Command Injection

Summary

execcmd() in modoboa/lib/sysutils.py always runs subprocess calls with shell=True. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server.

Details

The root cause is in modoboa/lib/sysutils.py:31:

python kwargs["shell"] = True process = subprocess.Popen(cmd, kwargs)

When a create a domain is created with DKIM enabled, the domain name gets embedded into a shell command like this:

python execcmd(f"openssl genrsa -out {dkimstoragedir}/{domain.name}.pem {keysize}")

If the domain name contains something like $(id>/tmp/proof).example.com, the shell executes the injected command before running openssl.

The same pattern appears in several other places:

- modoboa/admin/jobs.py:38 — mailbox rename via mv using fulladdress - modoboa/amavis/lib.py:202 — sa-learn using domain.name - modoboa/admin/models/mailbox.py:150 — doveadm user using fulladdress - modoboa/maillog/graphics.py:105–107 — rrdtool using domain.name - modoboa/webmail/models.py:54–57 — doveadm move/delete using account.email

PoC

1. Deploy modoboa <= 2.7.0 2. Log in as a Reseller or SuperAdmin 3. Create a new domain named $(id>/tmp/proof).example.com with DKIM enabled 4. SSH into the server and read /tmp/proof

Something like this will be displayed:

uid=0(root) gid=0(root) groups=0(root)

Confirmed on commit b521bcb4f (latest main at time of discovery).

Impact

An attacker with Reseller-level access (or higher) can execute arbitrary OS commands on the mail server — in a typical Modoboa deployment this means running as root. All six identified sinks are reachable through normal application workflows.