Path Traversal Vulnerability in Junrar Java RAR Archive Library

CVE-2026-28208

What is CVE-2026-28208?

The Junrar library, an open-source Java RAR archive utility, is susceptible to a path traversal vulnerability prior to version 7.5.8. This issue is due to improper validation in the LocalFolderExtractor component, enabling an attacker to extract crafted RAR files that can result in the writing of arbitrary files throughout the filesystem on Linux/Unix systems. This vulnerability may potentially lead to severe consequences, including remote code execution, allowing malicious actors to overwrite critical system files, including shell profiles and cron jobs. Version 7.5.8 rectifies this vulnerability, and users are encouraged to upgrade their installations promptly.

References