High severity7.0NVD Advisory· Published May 28, 2026· Updated Sep 1, 2026
CVE-2026-44604
CVE-2026-44604
Description
A command injection vulnerability was discovered in the rpmuncompress utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- osv-coords4 versionspkg:rpm/opensuse/python-rpm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rpm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rpm&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rpm-plugin-imaevmsign&distro=openSUSE%20Leap%2016.0
< 4.20.1-160000.3.1+ 3 more
- (no CPE)range: < 4.20.1-160000.3.1
- (no CPE)range: < 4.20.1-160000.3.1
- (no CPE)range: < 4.20.1-8.1
- (no CPE)range: < 4.20.1-160000.3.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.