CVE-2026-27180
Published: 18 February 2026
Description
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly…
more
from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to the saverestore module endpoint, preventing unauthenticated poisoning of the update URL and triggering of force_update.
Requires digitally signed software components with verification prior to installation, directly mitigating deployment of malicious tarballs via poisoned updates lacking integrity checks.
Performs integrity checks on software updates and detects unauthorized modifications, countering supply chain compromise through unverified downloads and extractions to the webroot.
Security SummaryAI
CVE-2026-27180 is a critical unauthenticated remote code execution vulnerability in MajorDoMo (also known as Major Domestic Module), an open-source home automation platform. The issue stems from the saverestore module, which exposes its admin() method via the /objects/?module=saverestore endpoint without authentication. This occurs because the module reads the mode parameter directly from $_REQUEST using gr('mode') rather than the framework's $this->mode. Additionally, the auto_update_settings mode handler allows poisoning of the system update URL, enabling supply chain compromise. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-494 (Download of Code Without Integrity Check). It was published on 2026-02-18.
An unauthenticated remote attacker can exploit this vulnerability with just two GET requests. First, the attacker poisons the update URL through the auto_update_settings handler. Second, they trigger the force_update handler, which calls autoUpdateSystem(). This method fetches an Atom feed from the attacker-controlled URL with only trivial validation, downloads a tarball using curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it via exec('tar xzvf ...'), and copies all files to the document root using copyTree(). Successful exploitation allows deployment of arbitrary PHP files, such as webshells, granting full control over the affected MajorDoMo instance.
Advisories and patches for mitigation are detailed in referenced sources, including a GitHub pull request at https://github.com/sergejey/majordomo/pull/1177, a technical analysis at https://chocapikk.com/posts/2026/majordomo-revisited/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/majordomo-supply-chain-remote-code-execution-via-update-url-poisoning. Security practitioners should review these for specific remediation steps, such as patching the saverestore module and securing update mechanisms.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE in public-facing web application (T1190) via update URL poisoning, enabling deployment of arbitrary PHP files such as webshells (T1100).