Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-12542

Foreman: command injection in foreman-tail

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Satellite 6.16 for RHEL 8

Default version status: affected

  • 0:3.12.0.23-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 9

Default version status: affected

  • 0:3.12.0.23-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.14.0.22-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.18 for RHEL 9

Default version status: affected

  • 0:3.16.0.25-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.19 for RHEL 9

Default version status: affected

  • 0:3.18.0.14-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6

Default version status: affected

References