CVE-2026-28208: falha de média gravidade em junrar
Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 15%
Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
junrar · junrarCVEs relacionadas — junrar
No mesmo produto, das mais perigosas para as menos.
CVE-2026-97370HIGHJunrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extractionEPSS 0.4%CVE-2026-86071LOWJunrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction rootEPSS 0.4%CVE-2026-41245MEDIUMJunrar: Path Traversal (Zip-Slip) via Sibling Directory Name PrefixEPSS 0.3%