PT-2025-45091 · Red Hat · Red Hat Satellite+1

Published 2025-11-05 · Updated 2026-02-06 · CVE-2025-10622

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Satellite (Foreman component) (affected versions not specified)

Description A flaw exists in Red Hat Satellite’s Foreman component that could allow an authenticated user with edit settings permissions to execute arbitrary commands on the operating system. This is due to inadequate server-side validation of command whitelisting. The issue involves the ct location and fcct location parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-602

CWE-78

Related Identifiers

CVE-2025-10622

RHSA-2025:19721

RHSA-2025:19832

RHSA-2025:19855

RHSA-2025:19856

Affected Products

Foreman

Red Hat Satellite

References · 14

• https://access.redhat.com/errata/RHSA-2025:19856 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:19855 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:19832 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:19721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10622 · Security Note
• https://access.redhat.com/security/cve/CVE-2025-10622 · Note
• https://theforeman.org/security.html#2025-10622 · Note
• https://t.me/cveNotify/141899 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2396020 · Note
• https://t.me/cveNotify/151219 · Telegram Post
• https://t.me/cveNotify/146721 · Telegram Post
• https://twitter.com/cracbot/status/1987837695968825486 · Twitter Post
• https://t.me/CVEtracker/36604 · Telegram Post
• https://t.me/cveNotify/141776 · Telegram Post