CVE-2026-86071 Details
Description
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.
A directory creation vulnerability has been identified in Junrar, an open-source Java library for RAR archives, in versions through 7.6.0. The issue arises in the LocalFolderExtractor component, where the extraction process can be manipulated to create directories outside the intended extraction root. This is achieved by crafting a RAR archive entry that exploits the way intermediate directory paths are created without proper validation, leading to filesystem pollution or interference with security-sensitive file operations.
Users can upgrade to Junrar version 7.6.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343 | [email protected] | Source CodeVendor |
| https://github.com/junrar/junrar/releases/tag/v7.6.1 | [email protected] | Release NotesVendor |
| https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Junrar | <= 7.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |