CVE-2026-86071

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86071
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86071.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86071
Aliases
Published
2026-09-16T19:05:42Z
Modified
2026-09-19T08:01:11Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
Details

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86071.json"
}
References

Affected packages

Git / github.com/junrar/junrar

Affected ranges

Type
GIT
Repo
https://github.com/junrar/junrar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e6e333b195a1e3ad271a18fd79d8ac1eb5289343
Fixed
9fd65e3449274100f23dd6d9c592e7a12b788d36
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

junrar-0.*
junrar-0.6
junrar-0.7
junrar-1.*
junrar-1.0.0
junrar-2.*
junrar-2.0.0
junrar-3.*
junrar-3.0.0
junrar-3.1.0
junrar-3.1.1
junrar-4.*
junrar-4.0.0
v4.*
v4.0.0
v5.*
v5.0.0
v6.*
v6.0.0
v6.0.1
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.3.0
v7.4.0
v7.4.1
v7.5.0
v7.5.1
v7.5.10
v7.5.2
v7.5.3
v7.5.4
v7.5.5
v7.5.6
v7.5.7
v7.5.8
v7.5.9
v7.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86071.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "283409260766733285923983080759583407426",
            "length": 584
        },
        "id": "CVE-2026-86071-47811f33",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343",
        "target": {
            "file": "src/main/java/com/github/junrar/LocalFolderExtractor.java",
            "function": "makeFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "39972015790290745324008206953962694436",
            "length": 572
        },
        "id": "CVE-2026-86071-9e11e4ab",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343",
        "target": {
            "file": "src/main/java/com/github/junrar/LocalFolderExtractor.java",
            "function": "createFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "242494767670473490940834829995755835869",
                "11338801022868555548742509458369174772",
                "187063472414524822230109492108464580369",
                "269280845128796657259597882100407737002",
                "119802140782819220837871678657273204316",
                "56811662258046707708533626268507395215"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-86071-cd3d5626",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343",
        "target": {
            "file": "src/test/java/com/github/junrar/LocalFolderExtractorTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "99893381690022168721326587497698881181",
                "276943704284780855336877155979869631713",
                "150233293072016361910675249658849503647",
                "307687105060871050883050616840985527085",
                "102640395307213807143061520838927850718",
                "291144724328561630503576081866000857588",
                "312826639538974628209022699818008449226",
                "204667039607004450098851307928099396903",
                "221708215009792905394935024467525434624",
                "147996778469443065919939746962657446475",
                "191171807687859971252571213999761163315",
                "284617932501392374365543255568068591653",
                "315498032256593425995314343990262338993",
                "231472009892396635887348729757789532189",
                "222116151549466254164202623282227753472",
                "194881856334378600498254624632179285568",
                "153870894979173923186827732366569671867",
                "125966424389890251186700583839503684307",
                "138730684097186347326888824533534582639",
                "213623137488470394074593957879506501520",
                "287813176796681903423116766187574872853",
                "222343694075022248482593144985410616153",
                "41918253359272478916530723619123935346",
                "149715562887613030807592230982114508343",
                "47756277416064825613438799892777646028",
                "185642344740358066521550349840509152890",
                "23647310957514595846496317888773344626",
                "30584587213142902972153208626010345669",
                "167941908862442392404353905925785322238",
                "98646397404819557023607423306590306102"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-86071-ddf60634",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343",
        "target": {
            "file": "src/main/java/com/github/junrar/LocalFolderExtractor.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-19T08:01:11Z"