CVE-2025-10622

Foreman: os command injection via ct_location and fcct_location parameters

Published Nov 5, 2025 CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Description
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.15::el8
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.15::el8
cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_utils:6.17::el9
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.
Title Foreman: os command injection via ct_location and fcct_location parameters
First Time appeared Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Maintenance
Redhat satellite Utils
Weaknesses CWE-602
CPEs cpe:/a:redhat:satellite:6
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_maintenance:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
Vendors & Products Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Maintenance
Redhat satellite Utils
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Feb 26, 2026, 5:47 PM
Reserved
Sep 17, 2025, 11:48 AM
Status
Deferred
Published
Nov 5, 2025, 8:15 AM
Modified
Oct 18, 2026, 9:10 PM
Severity
Important
Public date
Nov 1, 2025, 11:59 PM