Description

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-02T16:17:33.710Z",
  "pubdate": "2026-09-02T16:17:33.710Z",
  "executiveSummary": "A command injection vulnerability has been identified in the rpmuncompress utility. This flaw arises from improper sanitization of file names processed by the tool, allowing a local attacker to execute arbitrary commands with the privileges of the user running the command.\nThe vulnerability is classified as a command injection issue, where shell metacharacters within a specially crafted archive filename are passed directly to shell command strings without adequate escaping. The potential impact is high, as it compromises the confidentiality, integrity, and availability of data accessible to the user executing the tool.\nExploitation requires user interaction, specifically the execution of rpmuncompress on a malicious file via a human user or an automated workflow. Since the attack occurs locally, an attacker must have the ability to place the malicious archive within reach of the target system's execution path. The risk implications are significant in environments where rpmuncompress is frequently utilized for automated package or archive management, as it grants attackers the ability to execute system commands under the security context of the invoking user or service account.",
  "technicalDetails": "The root cause of this vulnerability is the insecure handling of user-supplied input—specifically archive filenames—within the rpmuncompress command-line interface. The utility fails to implement robust input validation or proper quoting mechanisms for shell metacharacters such as semicolons, backticks, pipes, or dollar signs when constructing command strings for subprocess execution.\nWhen rpmuncompress processes a filename containing such metacharacters, the underlying shell interprets these characters as instructions rather than literal components of the filename. This allows an attacker to break out of the intended command context and inject additional commands that are subsequently executed by the system shell.\nThe exploitation flow proceeds as follows: First, an attacker constructs an archive file with a malicious filename containing shell injection sequences, such as 'test; rm -rf /; .zip'. Second, the attacker ensures this file is delivered to a target environment where rpmuncompress is expected to process it. Third, a user or an automated service invokes rpmuncompress on the crafted file. Because the application fails to escape the filename string before passing it to the shell, the shell executes the primary rpmuncompress function followed by the injected commands. The injected payload executes with the same effective UID/GID as the process calling rpmuncompress.\nThe vulnerable component is the argument parsing and command construction logic within the rpmuncompress utility. There is no requirement for remote network access or authentication to exploit this flaw, as the vulnerability is strictly local. However, the requirement for user interaction creates a dependency on social engineering or automated workflow contamination to ensure the target command is executed on the malicious file. Upon successful command injection, the attacker can achieve persistent access, exfiltrate sensitive files, or manipulate the local filesystem, leading to a complete compromise of the local user's data and operational environment."
}