CVE-2026-44604

NameCVE-2026-44604
DescriptionA command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rpm (PTS)bullseye4.16.1.2+dfsg1-3vulnerable
bookworm4.18.0+dfsg-1+deb12u1vulnerable
trixie4.20.1+dfsg-3vulnerable
forky, sid6.0.1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rpmsource(unstable)(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2460967

Search for package or bug name: Reporting problems