CVE-2026-27602
2 advisories.
PyPI/modoboa CVE-2026-27602: high 7.2, EPSS 0.72%
Modoboa has OS Command Injection
Action: Upgrade modoboa to 2.7.1 or later.
pip install modoboa==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.1 | - |
Fixed versions
| 2.7.1 |
Sources
- osv: GHSA-wwv8-cqpr-vx3m
- https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3m
- https://nvd.nist.gov/vuln/detail/CVE-2026-27602
- https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfa
- https://github.com/modoboa/modoboa
- https://github.com/modoboa/modoboa/releases/tag/2.7.1
CVE-2026-27602 · published · modified · JSON
PyPI/modoboa CVE-2026-27602: high 7.2, EPSS 0.72%
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly in
Action: Upgrade modoboa to 2.7.1 or later.
pip install modoboa==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.1 | - |
Fixed versions
| 2.7.1 |
Sources
- osv: PYSEC-2026-2223
- https://github.com/modoboa/modoboa/releases/tag/2.7.1
- https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfa
- https://github.com/modoboa/modoboa/security/advisories/GHSA-wwv8-cqpr-vx3m
CVE-2026-27602 · published · modified · JSON