This advisory covers three security vulnerabilities fixed in Red Hat Satellite 6.15.5.2. CVE-2025-27407 is a remote code execution vulnerability in rubygem-graphql triggered by loading a crafted GraphQL schema. CVE-2025-27610 is a local file inclusion vulnerability in rubygem-rack's Rack::Static component. CVE-2024-56201 is a sandbox breakout vulnerability in python-jinja2 caused by malicious filenames. These vulnerabilities could allow attackers to execute arbitrary code or access unauthorized files. Red Hat Satellite 6.15 versions from 6.15.0 up to but not including 6.15.5.2 are affected. The vendor advisory recommends upgrading to version 6.15.5.2 which includes fixes for these issues.

Successful exploitation of these vulnerabilities could lead to remote code execution, local file inclusion, or sandbox escape, potentially compromising the confidentiality, integrity, and availability of affected systems. The vulnerabilities affect Red Hat Satellite 6.15 installations prior to 6.15.5.2, which is used for system provisioning and configuration management. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages in Red Hat Satellite 6.15.5.2 that fix these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata are applied. Detailed update instructions are available in the Red Hat Satellite documentation. No alternative mitigations or workarounds are specified in the advisory.