REDHAT-BUG-2459769: Path Traversal

Q: What conditions are required to exploit this issue?

An attacker must be able to supply a crafted RAR archive and cause the application to extract it using Junrar's LocalFolderExtractor. The crafted archive can cause files with attacker-controlled content to be written into sibling directories.

Q: Which version resolves the vulnerability?

Junrar version 7.5.10 fixes this path traversal issue.

Published Apr 20, 2026

Updated

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.

Affected Software

1 affected component

junrar<7.5.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Junrar (LocalFolderExtractor) to a version that resolves this vulnerability.
Fixed in 7.5.10

Event History

Apr 20, 2026

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must be able to supply a crafted RAR archive and cause the application to extract it using Junrar's LocalFolderExtractor. The crafted archive can cause files with attacker-controlled content to be written into sibling directories.

Which version resolves the vulnerability?

Junrar version 7.5.10 fixes this path traversal issue.

REDHAT-BUG-2459769: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

Which version resolves the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

Which version resolves the vulnerability?