Command Injection Vulnerability in rpmuncompress

CVE-2026-84838 is a command injection vulnerability residing within the rpmuncompress utility. The flaw exists due to improper sanitization of archive filenames, which allows an attacker to inject arbitrary shell metacharacters into the command execution flow. When a user or an automated script processes a malicious archive file using rpmuncompress, the unescaped filename is passed directly to the underlying shell command string. This leads to the execution of attacker-supplied commands with the privileges of the user running the utility. Defenders should be aware that this vulnerability facilitates local privilege escalation or arbitrary code execution, impacting the confidentiality, integrity, and availability of data accessible by the affected process.

Impact

Successful exploitation of CVE-2026-84838 allows a local attacker to execute arbitrary commands, potentially resulting in full system compromise for the specific user context in which rpmuncompress is invoked. Automated workflows that process externally sourced archive files are at higher risk.

Recommendation

• Monitor for the execution of rpmuncompress on systems processing external or untrusted archive files.
• Implement input validation on filenames before passing them to archive extraction utilities in automated workflows.
• Audit logs for instances where rpmuncompress is invoked with filenames containing shell metacharacters like semicolon (;), pipe (|), or backticks (`).