CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

• CWE-78

• https://access.redhat.com/security/cve/CVE-2026-84838
• https://bugzilla.redhat.com/show_bug.cgi?id=2462222

Published

Sep 2, 2026

Last Modified

Sep 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84832SEPPmail Secure Email Gateway before 15.0.6 deserializes att…8.6
• CVE-2026-84833A vulnerability was found in ntegrals openbrowser up to 067f…4.3
• CVE-2026-84834Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 v…9.8
• CVE-2026-84835Missing Authorization vulnerability in DimaFreund Rentsyst a…5.3
• CVE-2026-84836Subscriber Insecure Direct Object References (IDOR) in WC Uk…7.1
• CVE-2026-84837A flaw was found in rpm. An attacker can exploit a command i…7.8
• CVE-2026-84839A vulnerability was determined in tsi-coop tsi-dpdp-cms up t…5.3
• CVE-2026-8484A heap buffer overflow vulnerability exists in the Jansi JNI…4.8
• CVE-2026-84840A vulnerability was identified in tsi-coop tsi-dpdp-cms up t…6.5
• CVE-2026-84841A security flaw has been discovered in tsi-coop tsi-dpdp-cms…7.3
• CVE-2026-84847Unauthenticated Broken Access Control in Quick Event Manager…7.5
• CVE-2026-84848Unauthenticated Cross Site Scripting (XSS) in Quick Event Ma…7.1