https://seclists.org/oss-sec/2026/q4/67: CVE-2026-12541: Foman: command injection in foman-rake database tasks (fixed in 3.19.2, 5.0.1)

Q: Who can exploit this issue?

An attacker needs permission to run restricted foreman-rake database tasks. The CVSS vector identifies the attack as local and requiring high privileges, with no user interaction required.

Q: Which deployments are affected?

Foreman versions 1.5.0 through 3.19.1 are affected, as is version 5.0.0. The issue is fixed in Foreman 3.19.2 and 5.0.1.

Q: What is the impact if exploitation succeeds?

Unsafe shell handling of file path parameters can allow command execution. This can compromise both the Foreman server and its database, affecting confidentiality, integrity, and availability.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Foreman>=1.5.0<=3.19.1, =5.0.0

Frequently Asked Questions

Who can exploit this issue?

An attacker needs permission to run restricted foreman-rake database tasks. The CVSS vector identifies the attack as local and requiring high privileges, with no user interaction required.

Which deployments are affected?

Foreman versions 1.5.0 through 3.19.1 are affected, as is version 5.0.0. The issue is fixed in Foreman 3.19.2 and 5.0.1.

What is the impact if exploitation succeeds?

Unsafe shell handling of file path parameters can allow command execution. This can compromise both the Foreman server and its database, affecting confidentiality, integrity, and availability.