{"id":"CVE-2026-12542","summary":"Foreman: command injection in foreman-tail","details":"A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.","modified":"2026-10-24T10:51:08.790161210Z","published":"2026-10-01T17:14:49.985Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"InverseAffectedRanges","range":[{"fixed":"0:3.12.0.23-1.el8sat"},{"fixed":"0:3.12.0.23-1.el9sat"},{"fixed":"0:3.14.0.22-1.el9sat"},{"fixed":"0:3.16.0.25-1.el9sat"},{"fixed":"0:3.18.0.14-1.el9sat"}]}]}],"cna_assigner":"redhat","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12542.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/07/7"},{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74503"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74504"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74505"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74506"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-12542"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12542.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman","events":[{"introduced":"78ccdb2bcdb386618503afec4f465f58abfe619e"},{"last_affected":"48b7090bd69c44b7b8fc5ad95ee7be243f852819"},{"introduced":"092a456bdea31af4e91d7088856bd67aaff64c25"},{"last_affected":"092a456bdea31af4e91d7088856bd67aaff64c25"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"1.5.0"},{"last_affected":"3.19.1"}]},{"cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*","range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}],"source":"CPE_STRING"}]}}],"versions":["5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12542.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman-installer","events":[{"introduced":"8f63d97fd89e583a43c6f5bad49d4683a09ecf53"},{"last_affected":"dd9a3ad4746e606d79b4ced48d1dabdc79a52b49"},{"introduced":"e081fe7c568a5e597c0b9b6cfb025abf36edc2ff"},{"last_affected":"e081fe7c568a5e597c0b9b6cfb025abf36edc2ff"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.5.0"},{"last_affected":"3.19.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*"}]}}],"versions":["5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12542.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/smart-proxy","events":[{"introduced":"51bf654536f7464a69349fd27d6ecc7bfffb1923"},{"last_affected":"c5abbd9b13b34e6cd2055920bef27d8f03bbc80a"},{"introduced":"e63094f9ee6794882fabc2889877372459bf7072"},{"last_affected":"e63094f9ee6794882fabc2889877372459bf7072"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"1.5.0"},{"last_affected":"3.19.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*","range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}]}]}}],"versions":["5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12542.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}