Executive brief
A security vulnerability was found in the RPM package manager's archive extraction utility. When a user or automated system extracts a specially crafted archive file (such as ZIP or 7z), the tool can be tricked into executing hidden malicious commands. This could allow an attacker to take control of a user's system or disrupt automated software build processes.
Technical details
A command injection vulnerability exists in the `doUntar()` function within `tools/rpmuncompress.cc` of the RPM package manager. The utility fails to properly sanitize the top-level directory name (`sr`) retrieved from certain archive formats (ZIP, 7z, GEM) before interpolating it into a shell command string executed via `popen()`. An attacker can exploit this by crafting an archive with a single top-level directory name containing shell metacharacters (specifically single quotes). When a user executes `rpmuncompress -x -C` or uses RPM source-preparation workflows like `%setup -C`, the injected commands are executed with the privileges of the user running the extraction. The vulnerability is present in version 6.0.1 and likely other versions using the `singleRoot()` and `moveup` construction.
Affected products
- RPM Project RPM 6.0.1-5.1.hum1, upstream 6.0.1
Timeline
- 2026-04-23: disclosed: Initial report to Red Hat Bugzilla
- 2026-05-28: advisory: CVE published by NVD/Red Hat