CVE-2026-44604
Fixed in a distro release EPSS <1%CVSS 7.0
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
Products: Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rpm | no fix |
| Debian 13 | rpm | no fix |
| Debian 14 | rpm | no fix |
| Red Hat hummingbird 1 | python3-rpm | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-apidocs | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-build | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-build-libs | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-cron | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-devel | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-libs | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-audit | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-dbus-announce | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-fapolicyd | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-fsverity | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-ima | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-prioreset | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-selinux | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-syslog | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-systemd-inhibit | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-plugin-unshare | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-sign | 0:6.0.1-6.1.hum1 |
| Red Hat hummingbird 1 | rpm-sign-libs | 0:6.0.1-6.1.hum1 |
| SUSE Linux Enterprise Server 16.0 | python-rpm | 4.20.1-160000.3.1 |
| SUSE Linux Enterprise Server 16.0 | rpm | 4.20.1-160000.3.1 |
| SUSE Linux Enterprise Server 16.0 | rpm-plugin-imaevmsign | 4.20.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-rpm | 4.20.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rpm | 4.20.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rpm-plugin-imaevmsign | 4.20.1-160000.3.1 |
| SUSE Linux Micro 6.2 | python-rpm | 4.20.1-160000.3.1 |
| SUSE Linux Micro 6.2 | rpm | 4.20.1-160000.3.1 |
| SUSE Linux Micro 6.2 | rpm-plugin-imaevmsign | 4.20.1-160000.3.1 |
| Ubuntu 22.04 LTS | rpm | no fix |
| Ubuntu 24.04 LTS | rpm | no fix |
| Ubuntu 25.10 | rpm | no fix |
| Ubuntu 26.04 LTS | rpm | no fix |
| Ubuntu 26.10 | rpm | no fix |
| Ubuntu Pro 14.04 LTS | rpm | no fix |
| Ubuntu Pro 16.04 LTS | rpm | no fix |
| Ubuntu Pro 18.04 LTS | rpm | no fix |
| Ubuntu Pro 20.04 LTS | rpm | no fix |
| openSUSE Leap 16.0 | python-rpm | 4.20.1-160000.3.1 |
| openSUSE Leap 16.0 | rpm | 4.20.1-160000.3.1 |
| openSUSE Leap 16.0 | rpm-plugin-imaevmsign | 4.20.1-160000.3.1 |
| openSUSE Tumbleweed | rpm | 4.20.1-8.1 |