CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1)

[Ondrej Gajdusek <ogajduse () redhat com>]

Hi,

A security fix has been released in Foreman, an open-source lifecycle
management tool for physical and virtual servers.

CVE-2026-12541: Foreman: command injection in foreman-rake database tasks

A user allowed to run restricted `foreman-rake` database tasks can cause
command execution through file path parameters. Unsafe shell handling can
compromise the Foreman server and its database.

Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0
CVSS: 8.2 (Important)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Fixed versions: Foreman 3.19.2 and 5.0.1
Credit: Guilherme Suckevicz

References:
- Foreman Security: https://theforeman.org/security.html#2026-12541
- Redmine: https://projects.theforeman.org/issues/39839
- Fix: https://github.com/theforeman/foreman/pull/11310

Thanks,
Ondrej Gajdusek
Foreman Release Team