CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1)
Foreman patched CVE-2026-12541, a command injection in foreman-rake database tasks that can compromise the server.
Ondrej Gajdusek announced a fix for CVE-2026-12541 in Foreman, an open-source lifecycle management tool for physical and virtual servers. A user allowed to run restricted foreman-rake database tasks can trigger command execution through file-path parameters because of unsafe shell handling, which can compromise the Foreman server and its database. Affected versions include Foreman 1.5.0 through 3.19.1, with fixes in 3.19.2 and 5.0.1. The post does not report observed exploitation.
- Command injection is in foreman-rake database file-path parameters.
- An allowed user of restricted tasks can reach command execution.
- Abuse can compromise the Foreman server and its database.
- Fixes are available in Foreman 3.19.2 and 5.0.1.
Vulnerabilities mentionedAll →
- CVE-2026-125418.2—OS command injection in Foreman foreman-rake DB taskspublished · The Foreman Project Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12541 | OS command injection in Foreman foreman-rake DB tasks Foreman has OS command injection flaws (CWE-78) in the foreman-rake db:dump and db:import_dump tasks. The destination parameter used for backups and the file parameter used for imports are not sanitized before they are passed to a Ruby system() call, so an attacker who can run foreman-rake—for example via a restricted sudo rule—can append shell commands to those paths. Successful exploitation can run arbitrary commands with high impact on confidentiality, integrity, and availability; CVSS 3.1 rates it 8.2 (high) with changed scope, but it requires local access and high privileges (AV:L, PR:H) and is not an unauthenticated remote flaw. Affected version ranges are not stated in the provided data. No public proof-of-concept is known, and the CVE is not listed in the CISA KEV catalog. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12541: Foreman: command injection in foreman-rake database tasks A user allowed to run restricted `foreman-rake` database tasks can cause command execution through file path parameters. Unsafe shell handling can compromise the Foreman server and its database. Affected versions: Foreman 1.5.0 through 3.19.1, and...
This source does not provide full text. Read it at seclists.org.