CVE-2026-86071: Path Traversal Vulnerability in Junrar Archive Library
Vulnerability ID: CVE-2026-86071
CVSS Score: 3.7
Published: 2026-09-17
A directory traversal vulnerability exists in the Junrar archive extraction library prior to version 7.6.1. When extracting crafted RAR archives, the library allows unauthorized directory creation outside the designated destination root due to improper path normalization during directory creation.
TL;DR
Junrar versions before 7.6.1 are vulnerable to a directory traversal flaw allowing unauthorized directory creation via crafted archive entries.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network (AV:N)
- CVSS Score: 3.7 (Low)
- Exploit Status: PoC (Proof of Concept)
- KEV Status: Not Listed
Affected Systems
- Junrar Java archive library versions prior to 7.6.1
-
Junrar: < 7.6.1 (Fixed in:
7.6.1)
Code Analysis
Commit: e6e333b
Fix directory traversal in LocalFolderExtractor by utilizing Java NIO Path normalize
Mitigation Strategies
- Upgrade Junrar dependency to version 7.6.1
- Sanitize and reject archive entry paths containing relative traversal sequences
Remediation Steps:
- Identify any applications utilizing the Junrar library
- Update the Maven dependency coordinates to version 7.6.1
- Deploy the updated application to production environment
- Implement a custom pre-extraction validation step to reject paths containing path traversal components if upgrade is delayed
References
Read the full report for CVE-2026-86071 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)