CVE-2025-10622 — OS Command Injection in Foreman Foreman

CWE-78 — OS Command InjectionCWE-602 — Client-Side Enforcement of Server-Side Security4 documents4 sources
Severity
8.0HIGHNVD
EPSS
0.1%
top 76.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
THE Foreman Foreman
Timeline
PublishedNov 5

Description

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 1.3 | Impact: 6.0

Affected Packages1 packages

▶CVEListV5the_foreman/foreman3.12.0 — 3.16.1

🔴Vulnerability Details

2
GHSA
GHSA-f5h4-c4jw-c4gm: A flaw was found in Red Hat Satellite (Foreman component)↗2025-11-05
▶
CVEList
Foreman: os command injection via ct_location and fcct_location parameters↗2025-11-05
▶

📋Vendor Advisories

1
Red Hat
foreman: OS command injection via ct_location and fcct_location parameters↗2025-11-01
▶
CVE-2025-10622 — OS Command Injection | cvebase