CVE-2026-84838
Received Received - Intake

Command Injection in rpmuncompress Utility

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84838
EUVD
EUVD-2026-70109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat rpm to 4.19.1.1-23.el10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in the rpmuncompress tool. It allows a local attacker to execute arbitrary commands by tricking a user or automated workflow into processing a specially crafted archive file with shell metacharacters in its filename. The tool fails to properly escape these characters before passing them to shell commands, enabling command execution in the context of the user running rpmuncompress.

Detection Guidance

To detect this vulnerability, check if rpmuncompress is installed and inspect processes invoking it with untrusted filenames. Look for shell metacharacters in filenames processed by rpmuncompress. Commands like 'rpm -q rpm' can verify the package version. Check logs for rpmuncompress usage with suspicious filenames.

Impact Analysis

If exploited, this vulnerability can lead to high impact on confidentiality, integrity, and availability of data accessible to the user running rpmuncompress. An attacker could steal, modify, or delete data, install malware, or disrupt system operations within the user's privileges. Commands execute with the same permissions as the user invoking the tool.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data integrity issues, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using rpmuncompress on untrusted files risk non-compliance due to potential exposure of sensitive data or system compromise.

Mitigation Strategies

Avoid processing untrusted archive filenames with rpmuncompress. Rename source and patch archives to remove shell metacharacters before extraction. Update rpm to a patched version if available. Review workflows using %{__rpmuncompress} to ensure they handle filenames safely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart