Hi,

The following vulnerability was published for rpm.

CVE-2026-78367[0]:
| A vulnerability was found in RPM's rpmbuild tarball processing. When
| processing a crafted source archive, the getTarSpec() function in
| tools/rpmbuild.cc passes an attacker-controlled tar archive member
| name to rpmExpand() as part of a %{basename:...} macro expression. A
| specially crafted .spec member name can therefore inject RPM macros,
| including Lua expressions, resulting in arbitrary code execution
| with the privileges of the user running rpmbuild. This can be
| exploited when a victim or automated build system processes an
| attacker-controlled source tarball using rpmbuild tarball mode (such
| as -ts, -ta, or -tb).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-78367
https://www.cve.org/CVERecord?id=CVE-2026-78367
[1] https://github.com/rpm-software-management/rpm/issues/4314

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore