CVE-2026-84838
Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
What happened?
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| rpm-mainRed Hat | unaffected: 6.1.0-1.3.hum1 to < * | See vendor advisory |
| rpmRed Hat | Default status: affected | See vendor advisory |
| rpmRed Hat | Default status: unaffected | See vendor advisory |
| rpmRed Hat | Default status: unaffected | See vendor advisory |
| rpmRed Hat | Default status: unaffected | See vendor advisory |
| rpmRed Hat | Default status: unaffected | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.