CVE-2026-28208
Medium
Description
Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.
SeverityMedium
CVSS5.9
Exploit probability—
ProductJunrar
PublishedFeb 26, 2026
First seenFeb 26, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- junrar_project junrar7.5.8 or later
- com.github.junrar:junrar7.5.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| junrar_project junrar | v < 7.5.8 | 7.5.8 |
| com.github.junrar:junrarMaven | v < 7.5.8 | 7.5.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.