VDB

CVE-2026-12541

CVE-2026-12541 PUBLISHED CVSS 8.2 HIGH

Reported by redhat · Published October 1, 2026

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.

Risk Scores

CVSS 3.1
8.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Satellite 6.16 for RHEL 80:3.12.0.23-1.el8sat
Red HatRed Hat Satellite 6.16 for RHEL 90:3.12.0.23-1.el9sat
Red HatRed Hat Satellite 6.17 for RHEL 90:3.14.0.22-1.el9sat
Red HatRed Hat Satellite 6.18 for RHEL 90:3.16.0.25-1.el9sat
Red HatRed Hat Satellite 6.19 for RHEL 90:3.18.0.14-1.el9sat
Red HatRed Hat Satellite 6
Red HatRed Hat Satellite 6.19 for RHEL 90:3.18.0.14-1.el9sat, 0:3.18.0.14-1.el9sat, 0:3.18.0.14-1.el9sat
Red HatRed Hat Satellite 6
Red HatRed Hat Satellite 6.18 for RHEL 90:3.16.0.25-1.el9sat, 0:3.16.0.25-1.el9sat, 0:3.16.0.25-1.el9sat
Red HatRed Hat Satellite 6.17 for RHEL 90:3.14.0.22-1.el9sat, 0:3.14.0.22-1.el9sat
Red HatRed Hat Satellite 6.16 for RHEL 90:3.12.0.23-1.el9sat, 0:3.12.0.23-1.el9sat, 0:3.12.0.23-1.el9sat
Red HatRed Hat Satellite 6.16 for RHEL 80:3.12.0.23-1.el8sat, 0:3.12.0.23-1.el8sat, 0:3.12.0.23-1.el8sat

Timeline

  • Oct 1, 2026 Coalition ESS Score
  • Oct 1, 2026 CVE Published
  • Oct 1, 2026 Distribution Patch
  • Oct 1, 2026 Security Advisory
  • Oct 2, 2026 EPSS Score
  • Oct 3, 2026 EPSS Score
  • Oct 4, 2026 Distribution Patch
  • Oct 4, 2026 Security Advisory
  • Oct 4, 2026 Distribution Patch
  • Oct 4, 2026 Security Advisory
  • Oct 4, 2026 Distribution Patch
  • Oct 4, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›