The vulnerability resides in Modoboa’s exec_cmd function, which invokes subprocess calls with shell=True and directly incorporates domain names into the command string without sanitization. An attacker who can modify a domain name—such as a Reseller or SuperAdmin—can inject shell metacharacters to execute arbitrary operating‑system commands, compromising confidentiality, integrity and availability of the host system.

All Modoboa mail hosting deployments running a version earlier than 2.7.1 are affected, provided the user has Reseller or SuperAdmin permissions to create or edit domain names. Vendors and users of Modoboa should verify the running version and apply the 2.7.1 release, which removes the unsanitized shell invocation.

The CVSS score of 7.2 indicates moderate to high severity; the EPSS score of less than 1% suggests low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Inference indicates that an attacker can exploit the vulnerability remotely through the web interface by configuring a domain name that contains shell metacharacters, allowing execution of arbitrary commands on the server.