CVE-2026-28208 Details
Description
Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.
A backslash path traversal vulnerability has been identified in the Junrar library, specifically in versions prior to 7.5.8. This vulnerability allows an attacker to write arbitrary files with controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux or Unix systems. The issue arises because, on these platforms, backslashes are treated as literal characters rather than path separators. As a result, RAR entries with backslash-separated paths can bypass canonical path validation and be extracted outside the intended directory, potentially leading to remote code execution by overwriting sensitive files such as shell profiles or cron jobs.
Users can upgrade to Junrar version 7.5.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954 | [email protected] | Patch |
| https://github.com/junrar/junrar/releases/tag/v7.5.8 | [email protected] | ProductRelease Notes |
| https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| junrar project junrar | < 7.5.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 2, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |