CVE-2026-44604

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:28491
https://access.redhat.com/security/cve/CVE-2026-44604
https://bugzilla.redhat.com/show_bug.cgi?id=2460967

Configurations

No configuration.

History

26 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos fue descubierta en la utilidad ’rpmuncompress’ de RPM. Al extraer ciertos formatos de archivo (ZIP, 7z, GEM) a un directorio de destino especificado, la herramienta inserta el nombre de la carpeta de nivel superior del archivo en un comando de shell sin sanearlo adecuadamente. Un archivo especialmente diseñado que contiene metacaracteres de shell en el nombre de su carpeta puede ejecutar comandos arbitrarios como el usuario que ejecuta la extracción.

Information

Published : 2026-05-28 08:16

Updated : 2026-10-26 12:10

NVD link : CVE-2026-44604

Mitre link : CVE-2026-44604

CVE.ORG link : CVE-2026-44604

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-44604", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44604", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T12:15:12.073020Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "6.0.1-6.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rpm-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-28T08:16:35.280", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:28491", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-44604", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460967", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos fue descubierta en la utilidad \u2019rpmuncompress\u2019 de RPM. Al extraer ciertos formatos de archivo (ZIP, 7z, GEM) a un directorio de destino especificado, la herramienta inserta el nombre de la carpeta de nivel superior del archivo en un comando de shell sin sanearlo adecuadamente. Un archivo especialmente dise\u00f1ado que contiene metacaracteres de shell en el nombre de su carpeta puede ejecutar comandos arbitrarios como el usuario que ejecuta la extracci\u00f3n."}], "lastModified": "2026-10-26T12:10:00.130", "sourceIdentifier": "secalert@redhat.com"}