Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-28296. PoCs published by exploitintel.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2025-10622, an OS command injection vulnerability in Foreman. The PoC demonstrates how an authenticated administrator can bypass client-side validation to execute arbitrary commands via the `ct_location` or `fcct_location` settings.
Description
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
Exploits (1)
This repository contains functional exploit code for CVE-2025-10622, an OS command injection vulnerability in Foreman. The PoC demonstrates how an authenticated administrator can bypass client-side validation to execute arbitrary commands via the `ct_location` or `fcct_location` settings.
References (2)
Related Analysis
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N