CVE-2026-44604
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
29/100
Published: 2026-05-28
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.