{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.23-1.el8sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.23-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.22-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.25-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.14-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"satellite:el8/foreman","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-12541","cwes":["CWE-78"],"description":"A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.","epss":{"date":"2026-11-02","percentile":0.69078,"score":0.01236},"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793642494330,"publishedAt":1790871729928,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74503"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74504"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74505"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74506"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-12541"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/07/8"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}],"revision":"1c90f99966162648463ac7596d448be834062f2344658221cc799b361bb3f31b","sources":[{"modifiedAt":1793642494330,"name":"CNA: redhat","retrievedAt":1793642977327,"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793642982349,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12541"}],"ssvc":{"assessedAt":1790812800000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Foreman: command injection in foreman-rake database tasks","updatedAt":1793642982349}