CVE-2026-86071: Junrar LocalFolderExtractor path traversal via intermediate directory creation

CVE-2026-86071 · Severity: low · CVSS 3.7 · Published 2026-09-16

Junrar is a Java library for extracting RAR archives. The extraction process validates the final file path but fails to check intermediate directories created during extraction, allowing an attacker to create directories outside the intended extraction folder by providing a malicious RAR file. While this does not permit arbitrary file writes, it can be used for filesystem pollution and file-vs-directory squatting attacks.

Technologies: com.github.junrar:junrar (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-86071 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86071 being exploited in the wild.
How severe is CVE-2026-86071?
Low severity, with a CVSS score of 3.7, published 16 September 2026.
Which products and versions are affected?
com.github.junrar:junrar (Maven) <= 7.6.0, ECOSYSTEM:introduced=0,fixed=7.6.1.
Is there a fix for CVE-2026-86071?
Yes. com.github.junrar:junrar (Maven): upgrade to 7.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86071 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-86071?
Check whether you run com.github.junrar:junrar (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.github.junrar:junrar (Maven): upgrade to 7.6.1 or later
    # set com.github.junrar:junrar to 7.6.1 in your pom.xml or build.gradle

Technical details

The vulnerability is a path traversal weakness (CWE-22) in the LocalFolderExtractor class of Junrar. The createFile() method validates only the final canonical path against the destination directory, while the makeFile() method iteratively creates intermediate directories by calling mkdir() on each path segment without validating containment. An attacker can craft a RAR entry whose intermediate path components escape the extraction root (e.g., via symlinks or race conditions) while the final canonical path resolves within bounds, causing directory creation outside the intended destination. The attack requires the attacker to supply a malicious RAR file; no special privileges or user interaction is needed. No arbitrary file content write is possible, but filesystem pollution and denial-of-service via directory squatting are achievable. The vulnerability affects versions up to 7.6.0 and was patched in version 7.6.1.

Affected products

  • Junrar junrar <= 7.6.0

Identifiers

  • CVE-2026-86071
  • GHSA-89m4-43j5-vhhx

Timeline

  • 2026-07-21: disclosed
  • 2026-09-16: patched: Version 7.6.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.