CVE-2026-28208: Junrar Arbitrary File Write Vulnerability Due to Backslash Path Traversal Bypass
Summary
CVE-2026-28208: A backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Un... Affects com.github.junrar:junrar versions < 7.5.8. Fixed in 7.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Junrar is a Java library designed for extracting RAR archives. It provides a simple API for developers to integrate RAR file extraction capabilities into their applications. The library is widely used due to its ease of use and support for various RAR formats. However, a critical vulnerability has been identified that allows attackers to exploit the library's path handling, leading to potential arbitrary file writes on Linux/Unix systems.
Vulnerability Detail
A backslash path traversal vulnerability exists in the LocalFolderExtractor class of Junrar, allowing attackers to write arbitrary files to the filesystem when a specially crafted RAR archive is extracted. The vulnerability arises from the improper validation of file paths, where backslashes are treated as literal characters instead of path separators on Linux/Unix. This oversight enables attackers to bypass canonical path checks, leading to unauthorized file writes, which can result in remote code execution by overwriting sensitive files such as shell profiles or cron jobs.
How To Fix
Latest published version: 8.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid extracting RAR archives from untrusted sources or sanitize the filenames in the RAR archives before extraction to prevent backslash characters from being processed.
Conclusion
The Junrar library has a critical vulnerability that allows arbitrary file writes due to improper path validation. Users are strongly advised to update to the patched version 7.5.8 or later to mitigate the risk. Additionally, employing workarounds and monitoring tools like Vulert can help in managing vulnerabilities effectively.
See every vulnerability recorded for com.github.junrar:junrar →
FAQ
The vulnerability affects all Linux/Unix systems that use vulnerable versions of the Junrar library.
No, this vulnerability is not exploitable on Windows systems due to the different handling of backslashes as path separators.
An attacker can overwrite arbitrary files on the filesystem, which may lead to remote code execution or other malicious activities.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. You can check your application's pom.xml for vulnerabilities without any signup at Vulert Scanner.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.junrar:junrar.
