CVE-2026-28208CWE-22

Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

Medium · published February 26, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00771 · 55.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-26T22:20Z
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 12% → 1%
    epss
  • 26 FEB 22:20Z
    Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix
    cvelistv5