Executive brief
Junrar is a Java library for extracting RAR archives. The extraction process validates the final file path but fails to check intermediate directories created during extraction, allowing an attacker to create directories outside the intended extraction folder by providing a malicious RAR file. While this does not permit arbitrary file writes, it can be used for filesystem pollution and file-vs-directory squatting attacks.
Technical details
The vulnerability is a path traversal weakness (CWE-22) in the LocalFolderExtractor class of Junrar. The createFile() method validates only the final canonical path against the destination directory, while the makeFile() method iteratively creates intermediate directories by calling mkdir() on each path segment without validating containment. An attacker can craft a RAR entry whose intermediate path components escape the extraction root (e.g., via symlinks or race conditions) while the final canonical path resolves within bounds, causing directory creation outside the intended destination. The attack requires the attacker to supply a malicious RAR file; no special privileges or user interaction is needed. No arbitrary file content write is possible, but filesystem pollution and denial-of-service via directory squatting are achievable. The vulnerability affects versions up to 7.6.0 and was patched in version 7.6.1.
Affected products
- Junrar junrar <= 7.6.0
Timeline
- 2026-07-21: disclosed
- 2026-09-16: patched: Version 7.6.1 released
References
- https://api.github.com/users/smaeljaish771
- https://github.com/smaeljaish771
- https://api.github.com/users/smaeljaish771/gists%7B/gist_id%7D
- https://api.github.com/users/smaeljaish771/repos
- https://avatars.githubusercontent.com/u/266604088?v=4
- https://api.github.com/users/smaeljaish771/events%7B/privacy%7D