High · published October 1, 2026
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/satellite | all versions | — |
| redhat/satellite | ≥ 6.16, < 6.16.4 | 6.16.4 |
| redhat/satellite | ≥ 6.17, < 6.17.12 | 6.17.12 |
| redhat/satellite | ≥ 6.19, < 6.19.5 | 6.19.5 |
| theforeman/foreman | all versions | — |
| redhat/satellite | ≥ 6.18, < 6.18.10 | 6.18.10 |