CVE catalog

CVE-2026-28208

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
14.74% · Oct 25, 2026

A flaw was found in Junrar, an open-source Java RAR archive library. This vulnerability, a backslash path traversal, allows a remote attacker to write arbitrary files to any location on the filesystem when a specially crafted RAR archive is extracted on Linux/Unix systems. This can lead to remote code execution, enabling an attacker to compromise the system by overwriting critical files such as shell profiles or cron jobs. com.github.junrar/junrar: Junrar: Remote code execution via path traversal when extracting crafted RAR archives The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpejunrarNot reportedNot reportedunknown
Mavencom.github.junrar:junrarNot reported7.5.8fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Mavencom.github.junrar:junrarmavenNot reported7.5.8Not reportedNot reportedNot reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]