https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T22:13:14.050581+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-354852 EUVD-2026-354852 2026-10-04T22:13:14.087175+00:00 EUVD-2026-354852 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41245 fkie_cve-2026-41245 2026-10-04T22:13:14.087228+00:00

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-hf5p-q87m-crj7 GHSA-hf5p-q87m-crj7 — Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix 2026-10-04T22:13:14.087265+00:00

Affected: Maven: com.github.junrar:junrar

### Summary

A path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.

### Example

Given an extraction directory set to `/tmp/extract`, a crafted archive with an entry with the filename as `../extract_evil/file.txt` would be actually extracted to `/tmp/extract_evil/file.txt`.

### Details

The `createDirectory()` and `createFile()` methods in`LocalFolderExtractor` validate extraction paths using a string prefix.