GHSA-hf5p-q87m-crj7

Suggest an improvement
Source
https://github.com/advisories/GHSA-hf5p-q87m-crj7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hf5p-q87m-crj7/GHSA-hf5p-q87m-crj7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hf5p-q87m-crj7
Aliases
Published
2026-04-16T21:14:33Z
Modified
2026-05-05T16:11:47Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Details

Summary

A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.

Example

Given an extraction directory set to /tmp/extract, a crafted archive with an entry with the filename as ../extract_evil/file.txt would be actually extracted to /tmp/extract_evil/file.txt.

Details

The createDirectory() and createFile() methods inLocalFolderExtractor validate extraction paths using a string prefix.

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T21:14:33Z",
    "nvd_published_at":  "2026-04-20T16:16:49Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.github.junrar:junrar

Package

Name
com.github.junrar:junrar
View open source insights on deps.dev
Purl
pkg:maven/com.github.junrar/junrar

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.5.10

Affected versions

0.*
0.7
1.*
1.0.0
1.0.1
2.*
2.0.0
3.*
3.0.0
3.1.0
4.*
4.0.0
5.*
5.0.0
6.*
6.0.0
6.0.1
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
7.5.7
7.5.8
7.5.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hf5p-q87m-crj7/GHSA-hf5p-q87m-crj7.json"