Is CVE-2026-12541 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-12541?

CVE-2026-12541 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2026-12541

Description

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.