A command injection vulnerability was found in the rpm utility rpmuncompress. When an archive that includes a top‑level directory name containing shell metacharacters is extracted, the tool concatenates that directory name into a shell command without sanitization. This allows an attacker to execute arbitrary commands as the user running rpmuncompress, permitting uncontrolled code execution and potentially leading to local privilege escalation, data modification, or system compromise.

The vulnerability affects a wide range of Red Hat products. The RPMS binaries are present in Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10, as well as in Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, the Red Hat Pen Drive Powered by Red Hat Lightspeed product, Red Hat Hardened Images, and the Red Hat build of the Quarkus Native builder. All affected instances of rpmuncompress are susceptible; no specific version ranges are listed in the current data.

With a CVSS base score of 7, the vulnerability is considered high severity. Exploitation requires an attacker to supply a malicious archive to rpmuncompress and execute the command, so the attack vector is primarily local or requires initial compromise of an account with rights to run the utility. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a public patch at the time of this report increases the attacker's opportunity to exploit the flaw in unpatched environments.