Executive brief
rpmuncompress is a utility used to decompress RPM package archives during software installation and build workflows. A flaw in how it processes archive filenames allows a local attacker to execute arbitrary commands on a system if a user or automated build process attempts to decompress a maliciously named archive file. This could lead to unauthorized access, data theft, or system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in rpmuncompress where shell metacharacters in archive filenames are not properly escaped before being passed to shell command strings via popen(). An attacker can craft a specially named archive file that, when processed by rpmuncompress, executes arbitrary shell commands with the privileges of the user invoking the tool. The attack requires local file access and user interaction (a user or build workflow must invoke rpmuncompress on the attacker-controlled filename). The vulnerability cannot be triggered remotely or without explicit invocation. Red Hat classifies this as Moderate severity due to the requirement for user interaction and local attack vector, though the base CVSS score is 7.8.
Affected products
- Red Hat rpm
Timeline
- 2026-09-02: disclosed