CVE-2025-10622 Foreman: os command injection via ct_location and fcct_location parameters
Authenticated users with edit_settings permissions can execute arbitrary OS commands via insufficient validation in Foreman parameters.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10622?
CVE-2025-10622 is a high-severity command injection vulnerability in Red Hat Foreman, published on 5 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.
Weakness: CWE-78
Which versions are affected by CVE-2025-10622?
Linux distribution packages (19)
foreman Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-cli Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-debug Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-dynflow-sidekiq Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-ec2 Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-journald Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-libvirt Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-openstack Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-pcp Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-postgresql Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-redis Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-service Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-telemetry Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-vmware Red Hat:satellite:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman Red Hat:satellite_capsule:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-debug Red Hat:satellite_capsule:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-pcp Red Hat:satellite_capsule:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman Red Hat:satellite_utils:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
foreman-cli Red Hat:satellite_utils:6.18::el9 | All versions | 0:3.16.0.4-1.el9sat |
How do I fix CVE-2025-10622?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-10622 being exploited?
There is no known exploitation of CVE-2025-10622 in the wild and no public exploit code.
Sources
Also known as GHSA-f5h4-c4jw-c4gm, RHSA-2025:19721.