CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

This issue is rated Moderate because, although successful exploitation allows arbitrary command execution with the privileges of the invoking rpm process, it requires a user or automated workflow to run rpm -q -p (or a similar manifest-processing query/verify flow) directly against an attacker-supplied file. The vulnerable code is not exposed as a network service, and the operational mitigation --nomanifest fully suppresses the manifest fallback that triggers it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid querying untrusted files with rpm. When handling untrusted inputs, use the --nomanifest option to prevent macro expansion. For automation requiring manifest support, pre-validate entries to ensure only literal paths or globs are accepted and macro syntax is rejected.