CVE-2026-86071: Junrar Directory Creation Escape Vulnerability
Summary
CVE-2026-86071: Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root. Affects com.github.junrar:junrar versions < 7.6.1. Fixed in 7.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Junrar is an open-source Java library designed for extracting RAR files. It provides functionalities to handle RAR archives efficiently, making it a popular choice for developers needing to work with compressed files. However, it has a vulnerability that allows attackers to create directories outside the intended extraction root, potentially leading to filesystem pollution and security issues.
Vulnerability Detail
The vulnerability arises from the LocalFolderExtractor class, which only validates the final canonical file path before extraction. The method makeFile() creates intermediate directories without checking if they remain within the designated extraction directory. This flaw allows a malicious RAR entry to manipulate the extraction process, leading to the creation of directories outside the intended destination. The impact includes potential filesystem pollution and the risk of file-vs-directory squatting, where an attacker can create a directory at a path expected for a security-sensitive file, causing future writes to fail.
How To Fix
Latest published version: 8.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using RAR files from untrusted sources. Additionally, you can implement checks in your application to validate the paths of extracted files to ensure they remain within the intended directory.
Conclusion
The Junrar library has a vulnerability that allows for directory creation outside the intended extraction root, which can lead to significant security risks. It is crucial to update to the patched version 7.6.1 to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for com.github.junrar:junrar →
FAQ
CVE-2026-86071 is a vulnerability in the Junrar library that allows attackers to create directories outside the intended extraction root.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include filesystem pollution and the potential for file-vs-directory squatting, which can lead to security-sensitive files being overwritten or inaccessible.
Yes, the vulnerability is fixed in version 7.6.1 of the Junrar library. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.junrar:junrar.
