Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-28208 EUVD-2026-8909GHSA-j273-m5qq-6825

Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

Published Feb 26, 2026 · Updated Mar 2, 2026 · Assigned by GitHub_M

Description

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

Affected products

VendorProductAffectedFixed
junrar junrar < 7.5.8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.github.junrar:junrar < 7.5.8 7.5.8 GHSA-j273-m5qq-6825

References