Riskcovery

CVE-2026-12542

Foreman: command injection in foreman-tail

State
Published
Severity
5.3 Medium
Published
Oct 1, 2026
Updated
Oct 7, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
Red Hat Satellite 6.16 for RHEL 8Red Hat
  • 0:3.12.0.23-1.el8sat and laterNot affected
Red Hat Satellite 6.16 for RHEL 9Red Hat
  • 0:3.12.0.23-1.el9sat and laterNot affected
Red Hat Satellite 6.17 for RHEL 9Red Hat
  • 0:3.14.0.22-1.el9sat and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat
  • 0:3.16.0.25-1.el9sat and laterNot affected
Red Hat Satellite 6.19 for RHEL 9Red Hat
  • 0:3.18.0.14-1.el9sat and laterNot affected
Red Hat Satellite 6Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.