CVE-2026-44604

What it actually does

The flaw is a local, user-assisted command injection in RPM's `rpmuncompress` extraction helper. When processing ZIP, 7z, or Ruby GEM archives into a destination directory, `rpmuncompress` incorporates the archive's top-level folder name into a shell command without adequate sanitization. If that folder name contains shell metacharacters, the shell interprets them as syntax rather than data, allowing attacker-controlled commands to run with the privileges of the user or process performing the extraction. Impact can include arbitrary code execution, data theft, file modification, credential access, or follow-on privilege escalation if the extraction is performed by a privileged packaging, build, automation, or administrative workflow.

Why it matters to the business

An attacker who can convince a user, developer, build system, or automation process to extract a malicious archive with a vulnerable RPM utility can run commands on that system. This can compromise developer workstations, CI/build infrastructure, package-processing pipelines, or administrative hosts, potentially leading to theft of source code, secrets, signing keys, build artifacts, or broader environment access. The CVSS score is high, but exploitation requires local execution and user or workflow interaction; the low EPSS score and lack of known KEV listing indicate no confirmed broad exploitation signal at this time, though the issue remains important wherever untrusted archives are processed.

How an attack unfolds

An attacker prepares a ZIP, 7z, or GEM archive whose top-level directory name includes shell metacharacters and an embedded command payload. The attacker then delivers the archive through a channel where it is likely to be unpacked by RPM tooling, such as a package-ingestion workflow, developer handoff, build pipeline, security analysis sandbox, or manual extraction process. When a vulnerable `rpmuncompress` invocation extracts the archive to a destination directory, the crafted folder name is inserted into a shell command. The shell evaluates the metacharacters and executes the injected command as the account running the extraction. The attacker can use this first command to write files, execute a script, retrieve a second-stage payload, exfiltrate local data, or establish persistence, limited by the privileges and network access of the extraction context.

How to fix it

Upgrade RPM to a vendor-provided version that fixes `rpmuncompress` command construction for archive extraction. No exact fixed versions were provided in the input, so use the patched RPM package from the relevant operating system or distribution advisory. Prioritize systems that process untrusted archives, including developer workstations, CI/CD runners, build servers, package mirrors, artifact scanners, and automation hosts. Until patched, avoid using `rpmuncompress` on untrusted ZIP, 7z, or GEM files; process archives in isolated sandboxes or containers with no secrets, minimal privileges, no write access to sensitive paths, and restricted outbound network access. Where possible, validate archive top-level names before extraction and reject names containing shell metacharacters such as semicolons, pipes, ampersands, backticks, command substitutions, redirection characters, or embedded newlines.

How to confirm the fix worked

Confirm that the installed RPM package comes from a vendor advisory that remediates this issue. Inventory systems with RPM installed and identify workflows that invoke `rpmuncompress` directly or indirectly for ZIP, 7z, or GEM extraction. On Linux systems, check package versions with distribution-native tooling such as `rpm -q rpm` or the platform package manager and compare against the vendor's fixed release. Validate exposure by reviewing whether untrusted archives can reach automated extraction paths. In a controlled non-production test environment, use a benign proof-of-concept archive with a harmless command such as writing a marker file, then confirm the patched utility treats the crafted top-level folder name as data and does not execute the command. Do not run exploit tests on production systems.

Typical attack path

1. Create a ZIP, 7z, or GEM archive with a top-level folder name containing shell metacharacters and attacker-controlled command syntax.
2. Deliver the archive to a target user or workflow that processes untrusted archives with RPM tooling.
3. The victim or automation invokes vulnerable `rpmuncompress` extraction to a destination directory.
4. `rpmuncompress` constructs a shell command using the unsanitized top-level folder name.
5. The shell interprets the crafted folder name as command syntax and executes the injected command.
6. The attacker uses the resulting code execution to access files, retrieve additional payloads, steal secrets, alter build outputs, or move laterally depending on local privileges.

How to detect it

Look for evidence that `rpmuncompress` executed child processes that are not normal decompression helpers, particularly shells, download tools, scripting runtimes, or commands that write to temporary, user, startup, or build directories. Useful log sources include EDR process telemetry, Linux auditd `execve` records, Sysmon for Linux process creation events, shell history where applicable, CI/CD job logs, package-processing logs, artifact scanner logs, filesystem events, and network proxy/DNS logs. Focus on executions involving ZIP, 7z, or GEM archives followed immediately by unexpected `/bin/sh -c`, `bash -c`, `curl`, `wget`, `nc`, `python`, `perl`, `ruby`, `chmod`, or writes to `/tmp`, `/var/tmp`, user home directories, CI workspaces, or service directories. Review suspicious archives for top-level directory names containing semicolons, pipes, ampersands, backticks, `$(` command substitution, redirection characters, or embedded newlines. Because no public exploit campaign or fixed payload is identified, detection should emphasize behavioral indicators rather than a single static signature.

• rpmuncompress
• /usr/lib/rpm/rpmuncompress
• /bin/sh -c
• bash -c
• ppid_comm="rpmuncompress"
• parent_process_name=rpmuncompress
• process.parent.name:rpmuncompress
• rpmuncompress zip
• rpmuncompress 7z
• rpmuncompress gem
• archive top-level name contains ;
• archive top-level name contains |
• archive top-level name contains &
• archive top-level name contains `
• archive top-level name contains $(
• archive top-level name contains >
• archive top-level name contains <
• rpmuncompress spawned curl
• rpmuncompress spawned wget
• rpmuncompress spawned python
• rpmuncompress spawned perl
• rpmuncompress spawned ruby
• rpmuncompress spawned nc
• rpmuncompress spawned chmod

What your security team should do

• Patch RPM from the applicable operating system or distribution vendor, prioritizing archive-processing, build, CI/CD, developer, and administrative systems.
• Temporarily block or sandbox processing of untrusted ZIP, 7z, and GEM archives until affected systems are patched.
• Search endpoint telemetry for `rpmuncompress` spawning shells or scripting interpreters, especially `/bin/sh`, `bash`, `curl`, `wget`, `python`, `perl`, or `ruby`.
• Review recent package-ingestion, build, and artifact-processing jobs for suspicious archives or unexpected outbound network connections during extraction.
• Add pre-extraction validation to reject archive top-level paths containing shell metacharacters or control characters.
• Run archive extraction jobs with least privilege, isolated workspaces, no long-lived credentials, and restricted egress.
• Monitor vendor advisories for exact fixed RPM versions and apply updates consistently across downstream images, containers, and golden templates.