Foreman Command Injection and Telnetd Privilege Escalation - A Dropdown, a Blacklist, and Two Very Different Fixes
Foreman command injection via the REST API (CVE-2025-10622) and telnetd privilege escalation through environment variable injection (CVE-2026-28372) - CVEForge analyzes both end-to-end. One fix is a proper server-side whitelist. The other is a single unsetenv() call on a blacklist from 1995. Both produced working PoCs. Only one produced a fix we'd trust.