CVE-2026-41245
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
- Record
CVE-2026-41245- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-23872
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
- Record
EUVD-2026-23872- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf5p-q87m-crj7
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Summary
A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.
Example
Given an extraction directory set to /tmp/extract, a crafted archive with an entry with the filename as ../extract_evil/file.txt would be actually extracted to /tmp/extract_evil/file.txt.
Details
The createDirectory() and createFile() methods inLocalFolderExtractor validate extraction paths using a string prefix.
- Record
GHSA-hf5p-q87m-crj7- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
- Record
CVE-2026-41245- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
- Record
CVE-2026-41245- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-hf5p-q87m-crj7
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Summary
A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.
Example
Given an extraction directory set to /tmp/extract, a crafted archive with an entry with the filename as ../extract_evil/file.txt would be actually extracted to /tmp/extract_evil/file.txt.
Details
The createDirectory() and createFile() methods inLocalFolderExtractor validate extraction paths using a string prefix.
- Record
GHSA-hf5p-q87m-crj7- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVRHLW-2026-ed15c0b8d4d51966
Lightwell Security Advisory: junrar 7.5.5.rhlw-00001
Red Hat Lightwell has released com.github.junrar:junrar 7.5.5.rhlw-00001 with a backported security fix.
CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
This patched artifact is a drop-in replacement for com.github.junrar:junrar 7.5.5 from Maven Central.
- Record
RHLW-2026-ed15c0b8d4d51966- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.github.junrar:junrarMaven |
before 7.5.10 | 7.5.10 |
com.github.junrar:junrarMaven |
before 7.5.10, plus listed versions 0.71.0.01.0.12.0.03.0.0 Show 21 moreShow less3.1.04.0.05.0.06.0.06.0.17.0.07.1.07.2.07.3.07.4.07.4.17.5.07.5.17.5.27.5.37.5.47.5.57.5.67.5.77.5.87.5.9 |
7.5.10 |
com.github.junrar:junrarRed Hat Lightwell:Maven |
before 7.5.5.rhlw-00001, plus listed versions 0.71.0.01.0.12.0.03.0.0 Show 17 moreShow less3.1.04.0.05.0.06.0.06.0.17.0.07.1.07.2.07.3.07.4.07.4.17.5.07.5.17.5.27.5.37.5.47.5.5 |
7.5.5.rhlw-00001 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41245 is a medium vulnerability (CVSS 5.9) in Junrar, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in com.github.junrar:junrar 7.5.10.
References
github.com/junrar/junrar/security/advisories/GHSA-hf5p-q87m-crj7
access.redhat.com/security/cve/CVE-2026-41245
bugzilla.redhat.com/show_bug.cgi?id=2459769
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41245.json