EUVD-2026-32726
GHSA-q856-29gm-xf3x
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A command injection vulnerability was discovered in the rpmuncompress utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
AnalysisAI
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: identify and inventory all systems running RHEL 6-10, OpenShift Container Platform 4.x, Satellite 6.x, and Quarkus Native Builder in your environment; restrict archive extraction capabilities. Within 7 days: deploy compensating controls-disable or sandbox archive extraction operations, implement file integrity monitoring on extracted content, and enforce strict user permissions. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today