RHLW-2026-ed15c0b8d4d51966

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ed15c0b8d4d51966.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ed15c0b8d4d51966.json

JSON Data

https://api.osv.dev/v1/vulns/RHLW-2026-ed15c0b8d4d51966

Upstream

Published

2026-09-17T11:29:44Z

Modified

2026-10-27T04:00:17Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Lightwell Security Advisory: junrar 7.5.5.rhlw-00001

Details

Red Hat Lightwell has released com.github.junrar:junrar 7.5.5.rhlw-00001 with a backported security fix.

CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

This patched artifact is a drop-in replacement for com.github.junrar:junrar 7.5.5 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / com.github.junrar:junrar

Package

Name: com.github.junrar:junrar
Purl: pkg:maven/com.github.junrar/junrar

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.5.5.rhlw-00001

Affected versions

0.*

0.7

1.*

1.0.0

1.0.1

2.*

2.0.0

3.*

3.0.0

3.1.0

4.*

4.0.0

5.*

5.0.0

6.*

6.0.0

6.0.1

7.*

7.0.0

7.1.0

7.2.0

7.3.0

7.4.0

7.4.1

7.5.0

7.5.1

7.5.2

7.5.3

7.5.4

7.5.5

Database specific

lightwell

{
    "backport_base_version":  "7.5.5",
    "remediated_version":  "7.5.5.rhlw-00001",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ed15c0b8d4d51966.json"