What’s Vulnerable › Vulnerabilities

CVE-2023-0118: Foreman: arbitrary code execution through templates

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-20 · updated 2026-06-17
• Weakness: CWE-78

Description

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

Affected products

• Red Hat Satellite 6: from 6.13 before 6.13.3 — fixed in 6.13.3
• foreman: all versions

How to fix

Upgrade to a fixed version: Red Hat Satellite 6 6.13.3. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:4466
• https://access.redhat.com/errata/RHSA-2023:5979
• https://access.redhat.com/errata/RHSA-2023:5980
• https://access.redhat.com/errata/RHSA-2023:6818
• https://access.redhat.com/security/cve/CVE-2023-0118
• https://bugzilla.redhat.com/show_bug.cgi?id=2159291
• https://access.redhat.com/errata/RHSA-2023:4466
• https://access.redhat.com/errata/RHSA-2023:5979
• https://access.redhat.com/errata/RHSA-2023:5980
• https://access.redhat.com/errata/RHSA-2023:6818
• https://access.redhat.com/security/cve/CVE-2023-0118
• https://bugzilla.redhat.com/show_bug.cgi?id=2159291

Get alerted when CVE-2023-0118 or the next vulnerability affects your stack