{"id":"CVE-2022-30333","aliases":["DEBIAN-CVE-2022-30333","DLA-3534-1","EUVD-2022-52276","GHSA-h4mr-p94x-gf79","MGASA-2022-0206","SUSE-SU-2022:1760-1","UBUNTU-CVE-2022-30333","USN-6569-1","USN-7349-1","USN-7350-1"],"status":"published","title":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an...","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.99233,"percentile":0.99936,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2022-05-09T00:00:00Z","modified":"2026-11-03T06:02:31Z","kev":{"date_added":"2022-08-09","due_date":"2022-08-30","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-08-09"},{"source":"kev","since":"2022-08-09"}],"exploits":[{"source":"metasploit","id":"exploit/linux/fileformat/unrar_cve_2022_30333","title":"UnRAR Path Traversal (CVE-2022-30333)","type":"exploit","platform":"Linux","date":"2022-06-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/fileformat/unrar_cve_2022_30333"},{"source":"metasploit","id":"exploit/linux/http/zimbra_unrar_cve_2022_30333","title":"UnRAR Path Traversal in Zimbra (CVE-2022-30333)","type":"exploit","platform":"Linux","date":"2022-06-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/zimbra_unrar_cve_2022_30333"},{"source":"pocgithub","id":"TheL1ghtVn/CVE-2022-30333-PoC","title":"TheL1ghtVn/CVE-2022-30333-PoC","date":"2022-07-05","url":"https://github.com/TheL1ghtVn/CVE-2022-30333-PoC"},{"source":"pocgithub","id":"rbowes-r7/unrar-cve-2022-30333-poc","title":"rbowes-r7/unrar-cve-2022-30333-poc","date":"2022-07-15","url":"https://github.com/rbowes-r7/unrar-cve-2022-30333-poc"},{"source":"pocgithub","id":"aslitsecurity/Zimbra-CVE-2022-30333","title":"aslitsecurity/Zimbra-CVE-2022-30333","date":"2022-07-26","url":"https://github.com/aslitsecurity/Zimbra-CVE-2022-30333"},{"source":"pocgithub","id":"RakhithJK/CVE-2022-30333","title":"RakhithJK/CVE-2022-30333","date":"2022-08-15","url":"https://github.com/RakhithJK/CVE-2022-30333"},{"source":"pocgithub","id":"paradox0909/cve-2022-30333_online_rar_extracor","title":"paradox0909/cve-2022-30333_online_rar_extracor","date":"2024-06-10","url":"https://github.com/paradox0909/cve-2022-30333_online_rar_extracor"}],"fixes":[{"ecosystem":"Debian:12","package":"rar","fixed_in":["2:6.20~b1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rar","fixed_in":["2:6.20~b1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rar","fixed_in":["2:6.20~b1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unrar-nonfree","fixed_in":["1:6.1.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unrar-nonfree","fixed_in":["1:6.1.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unrar-nonfree","fixed_in":["1:6.1.7-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"rar","fixed_in":["2:6.20-0.1~deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"unrar","fixed_in":["6.00-3.1.mga8.nonfree"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"unrar","fixed_in":["5.6.1-4.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"unrar","fixed_in":["5.6.1-4.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"unrar","fixed_in":["5.6.1-4.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libclamunrar","fixed_in":["0.103.11-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rar","fixed_in":["2:6.23-1~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","fixed_in":["1:5.6.6-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libclamunrar","fixed_in":["0.103.11-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rar","fixed_in":["2:6.23-1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","fixed_in":["1:6.1.5-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rar","fixed_in":["2:6.23-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.20~b1-0.1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","3.30-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.20~b1-0.1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","3.30-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.20~b1-0.1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","3.30-2"]},{"source":"osv","ecosystem":"Debian:12","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.7-1"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.7-1"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.7-1"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"Debian:10","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.20-0.1~deb10u1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","2:6.20~b1-0.1","3.30-2"]},{"source":"osv","ecosystem":"Mageia:8","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-3.1.mga8.nonfree"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.5-1","0.99-1","0.99-1ubuntu0.1","0.100.1-1~ubuntu0.16.04.1","0.101.2-1~ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.3.b2-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.3.2-1","1:5.3.2-1+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99-4ubuntu1","0.100.1-1~ubuntu0.18.04.1","0.101.2-1~ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.4.0+dfsg.1-0.1","2:5.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.20.04.1"}]}],"versions":["0.101.2-1","0.101.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~20.04.1"}]}],"versions":["2:5.5.0-1","2:5.5.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.6-2ubuntu0.1"}]}],"versions":["1:5.6.6-2","1:5.6.6-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.22.04.1"}]}],"versions":["0.102.3-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~22.04.1"}]}],"versions":["2:5.5.0-1build1","2:5.5.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.5-1ubuntu0.1"}]}],"versions":["1:6.0.5-1","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.20.04.1"}]}],"versions":["0.101.2-1","0.101.2-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libclamunrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.22.04.1"}]}],"versions":["0.102.3-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~20.04.1"}]}],"versions":["2:5.5.0-1","2:5.5.0-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~22.04.1"}]}],"versions":["2:5.5.0-1build1","2:5.5.0-1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.6-2ubuntu0.1"}]}],"versions":["1:5.6.6-2","1:5.6.6-2build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.5-1ubuntu0.1"}]}],"versions":["1:6.0.5-1","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rarlab","product":"unrar"}],"references":[{"url":"https://www.rarlab.com/rar_add.htm","tags":["x_transferred","Product","web","report"]},{"url":"https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz","tags":["x_transferred","Patch","fix","report"]},{"url":"https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202309-04","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30333"},{"url":"https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day"},{"url":"https://github.com/advisories/GHSA-h4mr-p94x-gf79"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-30333","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0206.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30333.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199349","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30333","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-30333","tags":["report"]},{"url":"https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6569-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30333","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7350-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-33899","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-30333","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T00:00:00Z","modified":"2026-10-01T19:08:47.54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-59","CWE-22"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-52276","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T00:00:00Z","modified":"2026-10-01T19:08:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-08-09","updated_at":"2026-11-02T17:27:43.966642Z"}],"ghsa":[{"id":"GHSA-h4mr-p94x-gf79","title":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an...","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-10T00:00:21Z","modified":"2025-10-22T00:33:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-30333","title":"RARLAB UnRAR Directory Traversal Vulnerability","description":"RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.","cwes":["CWE-22","CWE-59"],"kev":{"date_added":"2022-08-09","due_date":"2022-08-30","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-30333","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T08:15:06.937Z","modified":"2026-10-02T14:54:55.84Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"CVE-2022-30333","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T08:15:06.937Z","modified":"2026-04-16T04:37:02.800415915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"UBUNTU-CVE-2022-30333","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T08:15:00Z","modified":"2026-10-27T04:15:24.696081975Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"DEBIAN-CVE-2022-30333","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","status":"published","published":"2022-05-09T08:15:06.937Z","modified":"2026-11-03T06:02:31.791213977Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DLA-3534-1","title":"rar - security update","status":"published","published":"2023-08-17T00:00:00Z","modified":"2026-03-09T01:22:29.261943Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0206","title":"Updated unrar packages fix security vulnerability","description":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to\nwrite to files during an extract (aka unpack) operation, as demonstrated\nby creating a ~/.ssh/authorized_keys file. (CVE-2022-30333)\n","status":"published","published":"2022-05-25T18:46:18Z","modified":"2026-04-16T04:41:00.508096388Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"SUSE-SU-2022:1760-1","title":"Security update for unrar","description":"This update for unrar fixes the following issues:\n\n- CVE-2022-30333: Fixed directory traversal issue that allowed writing to non-designated paths (bsc#1199349).\n","status":"published","published":"2022-05-19T16:03:03Z","modified":"2026-02-04T03:09:40.172642Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6569-1","title":"libclamunrar vulnerabilities","description":"it was discovered that libclamunrar incorrectly handled directories when\nextracting RAR archives. A remote attacker could possibly use this issue to\noverwrite arbitrary files and execute arbitrary code. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2022-30333)\n\nIt was discovered that libclamunrar incorrectly validated certain\nstructures when extracting RAR archives. A remote attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-40477)\n","status":"published","published":"2024-01-08T18:05:14Z","modified":"2026-10-27T04:15:36.794084149Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-7349-1","title":"rar vulnerabilities","description":"It was discovered that RAR incorrectly handled certain paths. If a user or\nautomated system were tricked into extracting a specially crafted RAR\narchive, a remote attacker could possibly use this issue to write arbitrary\nfiles outside of the targeted directory. (CVE-2022-30333)\n\nIt was discovered that RAR incorrectly handled certain recovery volumes. If\na user or automated system were tricked into extracting a specially crafted\nRAR archive, a remote attacker could possibly use this issue to execute\narbitrary code. (CVE-2023-40477)\n","status":"published","published":"2025-03-12T16:11:59Z","modified":"2026-10-27T04:15:47.132136662Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7350-1","title":"unrar-nonfree vulnerabilities","description":"It was discovered that UnRAR incorrectly handled certain paths. If a user\nor automated system were tricked into extracting a specially crafted RAR\narchive, a remote attacker could possibly use this issue to write arbitrary\nfiles outside of the targeted directory. (CVE-2022-30333, CVE-2022-48579)\n\nIt was discovered that UnRAR incorrectly handled certain recovery volumes.\nIf a user or automated system were tricked into extracting a specially\ncrafted RAR archive, a remote attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2023-40477)\n\nSiddharth Dushantha discovered that UnRAR incorrectly handled ANSI escape\nsequences when writing screen output. If a user or automated system were\ntricked into processing a specially crafted RAR archive, a remote attacker\ncould possibly use this issue to spoof screen output or cause a denial of\nservice. (CVE-2024-33899)\n","status":"published","published":"2025-03-12T16:19:29Z","modified":"2026-10-27T04:15:48.83070674Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}