CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junrarto a version that resolves this vulnerability.Fixed in 7.5.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41245?
CVE-2026-41245 is classified as a high-severity path traversal vulnerability.
How do I fix CVE-2026-41245?
To fix CVE-2026-41245, upgrade the Junrar library to version 7.5.10 or later.
What impact does CVE-2026-41245 have on affected systems?
CVE-2026-41245 allows attackers to write arbitrary files into sibling directories, potentially leading to data compromise.
Which versions of Junrar are affected by CVE-2026-41245?
CVE-2026-41245 affects Junrar versions prior to 7.5.10.
Is user interaction required to exploit CVE-2026-41245?
No, CVE-2026-41245 can be exploited remotely without user interaction.