Skip to content
OpenAdvisories

Package · Maven

com.github.junrar:junrar

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.5
    CVE-2026-97370

    Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. …

    junrar junrar com.github.junrar:junrar Maven
  • Low 3.7
    CVE-2026-86071

    Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

    Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. L…

    junrar junrar com.github.junrar:junrar Maven
  • Medium 5.9
    CVE-2026-41245

    Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

    Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archi…

    junrar junrar com.github.junrar:junrar Maven
  • Medium 5.9
    CVE-2026-28208 EPSS 15%

    Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

    Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafte…

    junrar junrar com.github.junrar:junrar Maven
  • High 7.5
    CVE-2022-23596

    Infinite loop in junrar

    Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be pro…

    com.github.junrar:junrar Maven
  • Medium 5.5
    CVE-2018-12418 Public exploit

    Junrar vulnerable to Infinite Loop

    Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.

    com.github.junrar:junrar Maven