Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by redhat

CVE-2026-44604Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

High 7.0

In plain English

A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-44604
Debian:13rpmno fix listedDEBIAN-CVE-2026-44604
Debian:14rpmno fix listedDEBIAN-CVE-2026-44604
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-44604
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-44604
Ubuntu:25.10rpmno fix listedUBUNTU-CVE-2026-44604
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-44604
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-44604

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References