CVE-2026-44604: Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

Synopsis

A command injection vulnerability exists in the rpmuncompress utility, part of the RPM package management toolchain shipped with Red Hat Enterprise Linux and related products. When extracting ZIP, 7z, or GEM archives, rpmuncompress passes the archive's top-level directory name directly into a popen() shell command without sanitizing it, allowing a crafted archive with shell metacharacters in its folder name to execute arbitrary commands. Successful exploitation gives the attacker full control over the process running the extraction, including read, write, and execution capabilities at that user's privilege level. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access; exploitation requires an existing process or shell session on the host that invokes rpmuncompress against a malicious archive.

• AuthenticationNot required

  No account credentials are required; the attacker only needs to supply a crafted archive to a user or process that will extract it.

• Victim interactionRequired

  A user or automated process must open and extract the attacker-supplied archive, making this a social-engineering or supply-chain vector that depends on the victim performing the extraction.

• Attack complexityDetail

  Attack complexity is HIGH, meaning reliable exploitation depends on environmental factors such as getting the crafted archive into a position where the target will extract it, rather than exploiting a straightforward, condition-free flaw.

Blast Radius

• Reads any file accessible to the user running rpmuncompress, including local credentials, SSH keys, and application secrets.
• Writes or overwrites files in that user's writable paths, enabling persistent backdoors or corruption of package metadata.
• Executes arbitrary commands at the privilege level of the extracting user, which in automated build pipelines may be an elevated service account.
• Disrupts the extraction process itself, potentially breaking package installation or build workflows that depend on it.