Executive brief
Junrar is an open-source Java library used to extract RAR archives. A security flaw allows a malicious actor to create a specially crafted RAR file that, when opened by an application using this library, can write files to unauthorized locations on the system. This could lead to the corruption of system files or the placement of malicious scripts in sensitive directories.
Technical details
A path traversal vulnerability (Zip-Slip variant) exists in Junrar's LocalFolderExtractor component. The createDirectory() and createFile() methods validate extraction paths using a string prefix check that is insufficient to prevent traversal into sibling directories. An attacker can exploit this by crafting a RAR archive containing filenames with '..' sequences (e.g., '../sibling_dir/file.txt'). When the library extracts such an archive, it may write files outside the intended destination directory. The vulnerability is fixed in version 7.5.10 by improving path validation logic.
Affected products
- Junrar Project Junrar < 7.5.10
- Red Hat Red Hat Fuse 7 7
Timeline
- 2026-04-15: patched: Version 7.5.10 released
- 2026-04-20: disclosed: Initial advisory published
References
- https://github.com/junrar/junrar/commit/d77e9a83eb721cd51f9c23d7869d0e6ad7f952d7
- https://github.com/junrar/junrar/releases/tag/v7.5.10
- https://github.com/junrar/junrar/security/advisories/GHSA-hf5p-q87m-crj7
- https://access.redhat.com/security/cve/CVE-2026-41245
- https://bugzilla.redhat.com/show_bug.cgi?id=2459769
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41245.json