Description
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected products
- RedHat / satellite6.16 – 6.16.4
- RedHat / satellite6.0 – 6.0
- theforeman / foreman1.5.0 – 3.19.1
- theforeman / foreman5.0.0 – 5.0.0
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:74503
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:74504
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:74505
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:74506
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-12542
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2489971
Updated 23m ago · 8 sources