CVE-2022-48579

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

7.5 HighFix available

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.84%Up 0.8 points since Aug 7, 2023

What each source reports

NVD Score used 7.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: CVE-2022-48579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: CVE-2022-48579
Updated: 2026-11-02

EUVDEUVD-2022-51275 No score

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: EUVD-2022-51275
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pg3x-qpq9-p4v6 7.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: GHSA-pg3x-qpq9-p4v6
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSVALPINE-CVE-2022-48579 7.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: ALPINE-CVE-2022-48579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

OSVAZL-27870 7.5

CVE-2022-48579 affecting package clamav for versions less than 0.105.2-2

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: AZL-27870
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 5 moreShow less

OSVAZL-34592 7.5

CVE-2022-48579 affecting package clamav for versions less than 0.105.2-4

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: AZL-34592
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-48579 7.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: DEBIAN-CVE-2022-48579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-48579 7.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: UBUNTU-CVE-2022-48579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV No score

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Record: CVE-2022-48579
Updated: 2026-11-02

OSVUSN-7350-1 No score

unrar-nonfree vulnerabilities

It was discovered that UnRAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. (CVE-2022-30333, CVE-2022-48579)

It was discovered that UnRAR incorrectly handled certain recovery volumes. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2023-40477)

Siddharth Dushantha discovered that UnRAR incorrectly handled ANSI escape sequences when writing screen output. If a user or automated system were tricked into processing a specially crafted RAR archive, a remote attacker could possibly use this issue to spoof screen output or cause a denial of service. (CVE-2024-33899)

Record: USN-7350-1
Updated: 2026-11-02

Affected products

rarlab unrar

Affected packages

Affected packages
Package	Affected	Fixed
`clamav` Alpine:v3.18	before 1.1.2-r0	1.1.2-r0
`clamav` Alpine:v3.19	before 1.2.0-r0	1.2.0-r0
`clamav` Alpine:v3.20	before 1.2.0-r0	1.2.0-r0
`clamav` Alpine:v3.21	before 1.2.0-r0	1.2.0-r0
`clamav` Alpine:v3.22	before 1.2.0-r0	1.2.0-r0
`clamav` Alpine:v3.23	before 1.2.0-r0	1.2.0-r0
`clamav` Alpine:v3.24	before 1.2.0-r0	1.2.0-r0
`clamav` Azure Linux:2	before 0.105.2-2	0.105.2-2
`clamav` Azure Linux:3	before 0.105.2-4	0.105.2-4
`unrar-nonfree` Debian:12	before 1:6.2.3-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less 1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2	1:6.2.3-1

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`unrar-nonfree` Debian:13	before 1:6.2.3-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less 1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2	1:6.2.3-1
`unrar-nonfree` Debian:14	before 1:6.2.3-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less 1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2	1:6.2.3-1
`unrar-nonfree` Debian:10	before 1:5.6.6-1+deb10u3, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 34 moreShow less 1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-1+deb10u11:5.6.6-1+deb10u23.3.6-23.3.6-2.0.13.4.3-1	1:5.6.6-1+deb10u3
`unrar-nonfree` Ubuntu:16.04:LTS	All versions, plus listed versions 1:5.3.2-11:5.3.2-1+deb9u1build0.16.04.1	None known
`unrar-nonfree` Ubuntu:18.04:LTS	All versions, plus listed versions 1:5.5.8-1	None known
`unrar-nonfree` Ubuntu:20.04:LTS	before 1:5.6.6-2ubuntu0.1, plus listed versions 1:5.6.6-21:5.6.6-2build1	1:5.6.6-2ubuntu0.1
`unrar-nonfree` Ubuntu:22.04:LTS	before 1:6.1.5-1ubuntu0.1, plus listed versions 1:6.0.5-11:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-21:6.1.4-11:6.1.5-1	1:6.1.5-1ubuntu0.1
`unrar-nonfree` Ubuntu:20.04:LTS From an advisory covering 4 CVEs	before 1:5.6.6-2ubuntu0.1, plus listed versions 1:5.6.6-21:5.6.6-2build1	1:5.6.6-2ubuntu0.1
`unrar-nonfree` Ubuntu:22.04:LTS From an advisory covering 4 CVEs	before 1:6.1.5-1ubuntu0.1, plus listed versions 1:6.0.5-11:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-21:6.1.4-11:6.1.5-1	1:6.1.5-1ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-48579 is a high vulnerability (CVSS 7.5) in Rarlab Unrar, published August 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in clamav 1.1.2-r0.

References

Show 7 moreShow less

This page doesn't list everything

Left out here: 48 versions. The JSON record has them.