Every CVE Search/ Get API key

CVE-2022-30333

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an...

7.5 HighIn KEVPublic exploitFix available

CVE-2022-30333 is a high vulnerability (CVSS 7.5) in Debian Linux, published May 9, 2022. CISA lists it as known to be exploited, since August 9, 2022. EUVD reports exploitation since August 9, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.2%, the 99th percentile. Fixed in rar 2:6.20~b1-0.1.

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

99.2%Up 98.3 points since May 9, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
CVE-2022-30333
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
CVE List 9.8

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
CVE-2022-30333
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-59, CWE-22
Updated
2026-11-02
EUVDEUVD-2022-52276 9.8

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
EUVD-2022-52276
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h4mr-p94x-gf79 7.5

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an...

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
GHSA-h4mr-p94x-gf79
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
CISA KEV No score

RARLAB UnRAR Directory Traversal Vulnerability

RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.

Record
CVE-2022-30333
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSV 7.5

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
CVE-2022-30333
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2022-30333 9.8

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
UBUNTU-CVE-2022-30333
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2022-30333 No score

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Record
DEBIAN-CVE-2022-30333
Updated
2026-11-03
OSVMGASA-2022-0206 No score

Updated unrar packages fix security vulnerability

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. (CVE-2022-30333)

Record
MGASA-2022-0206
Updated
2026-11-02
OSVSUSE-SU-2022:1760-1 No score

Security update for unrar

This update for unrar fixes the following issues:

  • CVE-2022-30333: Fixed directory traversal issue that allowed writing to non-designated paths (bsc#1199349).
Record
SUSE-SU-2022:1760-1
Updated
2026-11-02
OSVUSN-6569-1 No score

libclamunrar vulnerabilities

it was discovered that libclamunrar incorrectly handled directories when extracting RAR archives. A remote attacker could possibly use this issue to overwrite arbitrary files and execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2022-30333)

It was discovered that libclamunrar incorrectly validated certain structures when extracting RAR archives. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2023-40477)

Record
USN-6569-1
Updated
2026-11-02
OSVUSN-7349-1 No score

rar vulnerabilities

It was discovered that RAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. (CVE-2022-30333)

It was discovered that RAR incorrectly handled certain recovery volumes. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2023-40477)

Record
USN-7349-1
Updated
2026-11-02
OSVUSN-7350-1 No score

unrar-nonfree vulnerabilities

It was discovered that UnRAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. (CVE-2022-30333, CVE-2022-48579)

It was discovered that UnRAR incorrectly handled certain recovery volumes. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2023-40477)

Siddharth Dushantha discovered that UnRAR incorrectly handled ANSI escape sequences when writing screen output. If a user or automated system were tricked into processing a specially crafted RAR archive, a remote attacker could possibly use this issue to spoof screen output or cause a denial of service. (CVE-2024-33899)

Record
USN-7350-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rar
Debian:12
 before 2:6.20~b1-0.1, plus listed versions
1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1
Show 27 moreShow less
1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.13.30-2
2:6.20~b1-0.1
rar
Debian:13
 before 2:6.20~b1-0.1, plus listed versions
1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1
Show 27 moreShow less
1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.13.30-2
2:6.20~b1-0.1
rar
Debian:14
 before 2:6.20~b1-0.1, plus listed versions
1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1
Show 27 moreShow less
1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.13.30-2
2:6.20~b1-0.1
unrar-nonfree
Debian:12
 before 1:6.1.7-1, plus listed versions
1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1
Show 45 moreShow less
1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2
1:6.1.7-1
unrar-nonfree
Debian:13
 before 1:6.1.7-1, plus listed versions
1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1
Show 45 moreShow less
1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2
1:6.1.7-1
unrar-nonfree
Debian:14
 before 1:6.1.7-1, plus listed versions
1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1
Show 45 moreShow less
1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2
1:6.1.7-1
rar
Debian:10
 before 2:6.20-0.1~deb10u1, plus listed versions
1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1
Show 28 moreShow less
1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.12:6.20~b1-0.13.30-2
2:6.20-0.1~deb10u1
unrar
Mageia:8
 before 6.00-3.1.mga8.nonfree
6.00-3.1.mga8.nonfree
unrar
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 5.6.1-4.8.1
5.6.1-4.8.1
unrar
SUSE:Linux Enterprise Server 12 SP5
 before 5.6.1-4.8.1
5.6.1-4.8.1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
unrar
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 5.6.1-4.8.1
5.6.1-4.8.1
libclamunrar
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.98.5-10.99-10.99-1ubuntu0.10.100.1-1~ubuntu0.16.04.10.101.2-1~ubuntu0.16.04.1
 None known
rar
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:5.3.b2-1
 None known
unrar-nonfree
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:5.3.2-11:5.3.2-1+deb9u1build0.16.04.1
 None known
libclamunrar
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.99-4ubuntu10.100.1-1~ubuntu0.18.04.10.101.2-1~ubuntu0.18.04.1
 None known
rar
Ubuntu:18.04:LTS
 All versions, plus listed versions
2:5.4.0+dfsg.1-0.12:5.5.0-1
 None known
unrar-nonfree
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:5.5.8-1
 None known
libclamunrar
Ubuntu:20.04:LTS
 before 0.103.11-0ubuntu0.20.04.1, plus listed versions
0.101.2-10.101.2-1build1
0.103.11-0ubuntu0.20.04.1
rar
Ubuntu:20.04:LTS
 before 2:6.23-1~20.04.1, plus listed versions
2:5.5.0-12:5.5.0-1build1
2:6.23-1~20.04.1
unrar-nonfree
Ubuntu:20.04:LTS
 before 1:5.6.6-2ubuntu0.1, plus listed versions
1:5.6.6-21:5.6.6-2build1
1:5.6.6-2ubuntu0.1
libclamunrar
Ubuntu:22.04:LTS
 before 0.103.11-0ubuntu0.22.04.1, plus listed versions
0.102.3-3
0.103.11-0ubuntu0.22.04.1
rar
Ubuntu:22.04:LTS
 before 2:6.23-1~22.04.1, plus listed versions
2:5.5.0-1build12:5.5.0-1.1
2:6.23-1~22.04.1
unrar-nonfree
Ubuntu:22.04:LTS
 before 1:6.1.5-1ubuntu0.1, plus listed versions
1:6.0.5-11:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-21:6.1.4-11:6.1.5-1
1:6.1.5-1ubuntu0.1
rar
Ubuntu:24.04:LTS
 before 2:6.23-1
2:6.23-1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitUnRAR Path Traversal (CVE-2022-30333)2022-06-28
MetasploitUnRAR Path Traversal in Zimbra (CVE-2022-30333)2022-06-28
PoC in GitHubTheL1ghtVn/CVE-2022-30333-PoC2022-07-05
PoC in GitHubrbowes-r7/unrar-cve-2022-30333-poc2022-07-15
PoC in GitHubaslitsecurity/Zimbra-CVE-2022-303332022-07-26
PoC in GitHubRakhithJK/CVE-2022-303332022-08-15
PoC in GitHubparadox0909/cve-2022-30333_online_rar_extracor2024-06-10

History

History
WhenChangedSources
2026-11-03exploitation
2026-11-03exploitsOSV
2026-11-02createdCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub

References

Show 20 moreShow less
This page doesn't list everything

Left out here: 24 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open