Vulnerability GHSA-hf5p-q87m-crj7
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
6 months ago
April 16, 2026 at 09:14 PM UTC
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
0.7 - 7.5.9
0.7 - 7.5.9
Summary
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Details
Summary
A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.
Example
Given an extraction directory set to /tmp/extract, a crafted archive with an entry with the filename as ../extract_evil/file.txt would be actually extracted to /tmp/extract_evil/file.txt.
Details
The createDirectory() and createFile() methods inLocalFolderExtractor validate extraction paths using a string prefix.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
0.7 - 7.6.0 GHSA-h9h9-2rmf-rvhp
0.7 - 7.6.0 GHSA-h9h9-2rmf-rvhp
Low Risk
28 days ago
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
0.7 - 7.6.0 GHSA-89m4-43j5-vhhx
0.7 - 7.6.0 GHSA-89m4-43j5-vhhx
Medium Risk
7 months ago
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
0.7 - 7.5.7 GHSA-j273-m5qq-6825
0.7 - 7.5.7 GHSA-j273-m5qq-6825
High Risk
4 years ago
Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive
0.7 - 7.4.0 GHSA-m6cj-93v6-cvr5
0.7 - 7.4.0 GHSA-m6cj-93v6-cvr5
Medium Risk
8 years ago
Junrar vulnerable to Infinite Loop
0.7 - 1.0.0 GHSA-5xqr-grq4-qwgx
0.7 - 1.0.0 GHSA-5xqr-grq4-qwgx
Impacted packages
Timeline
Published
6 months ago
April 16, 2026 at 09:14 PM UTC
Fixed (7.5.10)
Unknown
Unknown
Last Modified
5 months ago
May 05, 2026 at 04:11 PM UTC