A flaw was discovered in Foreman where the foreman‑rake db:dump and db:import_dump tasks fail to sanitize the user‑supplied destination and file arguments before passing them to a Ruby system() call. An attacker who can run foreman‑rake—such as a user with sudo or other privileged access—can append arbitrary shell commands to these parameters, causing the host to execute those commands with the privileges of the running process, potentially leading to full compromise of the machine.

The vulnerability affects Red Hat Satellite 6 and Red Hat Satellite 6.19 for RHEL 9, along with related Satellite Capsule and Utils components. The affected product versions are those listed under the CNA identifiers Red Hat:Red Hat Satellite 6 and Red Hat:Red Hat Satellite 6.19 for RHEL 9. No further version granularity is supplied.

The CVSS score of 8.2 indicates a high level of severity. The EPSS score is 1%, and the issue is not listed in the CISA KEV catalog, so current exploitation rates are unknown. The likely attack vector is local: an attacker who can invoke foreman‑rake can craft the destination or file arguments to inject shell commands, resulting in arbitrary code execution. No public exploit has been reported, but the high severity warrants rapid remediation.