Skip to content
fr Sign in
5.9 Medium

CVE-2026-28208 Junrar is an open source java RAR archive library

Description

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

Affected products and versions

Product Affected versions Fixed in
junrar 7.5 earliest → < 7.5.8 7.5.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of junrar

The 4 CVEs of junrar →
CVE-2026-97370 Junrar is an open source Java RAR archive library 7.5 High CVE-2026-86071 Junrar is an open source Java RAR archive library 3.7 Low CVE-2026-41245 Junrar is an open source java RAR archive library 5.9 Medium
Track this CVE