MajorDoMo is vulnerable to unauthenticated remote code execution in the saverestore module, which exposes an admin() method without authentication. The flaw is a classic example of CWE-494, where the system downloads content from an untrusted source. By poisoning the auto_update_settings URL, an attacker can cause the system to fetch an Atom feed from an attacker-controlled location with TLS verification disabled, download a tarball, execute it via exec(), and copy its contents to the web root. This sequence requires only two unauthenticated GET requests, allowing the attacker to place arbitrary PHP files, including web shells, into the document root.

The affected vendor is sergejey:MajorDoMo. All releases of MajorDoMo that include the saverestore module and auto_update functionality are vulnerable; the CVE entry does not list specific version numbers, so any publicly available release without an applied patch or configuration change remains at risk.

The base CVSS score of 9.3 indicates critical severity. An EPSS score of 48% reflects a high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog but remains a priority because it can be triggered remotely without authentication or privileged access. The supply‑chain nature of the flaw means that any system relying on automatic updates is directly exposed, making exploitation especially straightforward.