CVE-2026-44604
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it.
Risk Assessment
An attacker can create a specially crafted archive containing shell metacharacters in its folder name, allowing arbitrary commands to be executed as the user running the extraction. This could lead to serious security breaches in the system.
Recommendation
It is recommended to update the RPM tool to the latest version that fixes this vulnerability. Additionally, avoid extracting archives from untrusted sources.
Original NVD description (English source)
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.