Description
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| modoboa | modoboa | < 2.7.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | modoboa | < 2.7.1 | 2.7.1 | GHSA-wwv8-cqpr-vx3m |