CVE-2026-12541

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description OS command injection flaws exist in the foreman-rake db:dump and db:import dump tasks. The application does not properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake, such as through a restricted sudo configuration, can append malicious shell commands to the provided file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.