{"id":"CVE-2026-12541","published":"2026-10-01T17:17:20.190","lastModified":"2026-10-07T07:17:00.257","description":"A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/8","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows OS command injection through the foreman-rake db:dump and db:import_dump tasks, enabling attackers to execute arbitrary shell commands with the permissions of the application.","exploitability":"Exploitation requires the ability to execute foreman-rake tasks, which may be possible via restricted sudo configurations. The vulnerability is relatively easy to exploit given the necessary permissions.","blast_radius":"If exploited, the impact could be severe, as it allows full control over the system through the execution of arbitrary commands with the application's privileges.","remediation":"Disable the affected foreman-rake db:dump and db:import_dump tasks until a patch is available, or upgrade to the latest version of Foreman that addresses this issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","os-command-injection","foreman","patch-required"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:43:22.783Z"}}