CVE-2026-44604 in RPM
요약
\~에 의해 MITRE • 2026. 05. 28.
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
VulDB is the best source for vulnerability data and more expert information about this specific topic.