Description
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
Problem types
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Product status
Timeline
| 2026-04-23: | Reported to Red Hat. |
| 2026-05-28: | Made public. |
References
access.redhat.com/security/cve/CVE-2026-44604
bugzilla.redhat.com/show_bug.cgi?id=2460967 (RHBZ#2460967)