CVE-2026-41245

What it actually does

CVE-2026-41245 is a path traversal vulnerability in Junrar's LocalFolderExtractor component prior to version 7.5.10. When an application extracts a maliciously crafted RAR archive using the vulnerable library, archive entry paths can escape the intended extraction directory and write attacker-controlled files into sibling directories. The primary technical impact is unauthorized file creation or overwrite with attacker-controlled content. Confidentiality is not directly affected, and availability impact is not inherent, but integrity impact is significant if written files influence application behavior, configuration, web content, jobs, or downstream processing.

Why it matters to the business

Organizations using vulnerable Junrar versions in file upload, document intake, email attachment processing, archive inspection, or automated extraction workflows may allow untrusted archives to modify files outside the expected destination. In business terms, this can lead to tampered application files, corrupted records, unauthorized content placement, or a stepping stone to further compromise if the overwritten location is executed or trusted by another process. The CVSS score is moderate and EPSS is currently low, with no CISA KEV listing or known ransomware association, but exposure is more serious in internet-facing or automated archive-processing services where attackers can submit RAR files at scale.

How an attack unfolds

An attacker first identifies an application or service that accepts or processes RAR archives and uses a vulnerable Junrar version before 7.5.10. The attacker crafts a RAR file containing entries with traversal-style paths designed to resolve outside the intended extraction folder and into a sibling directory. When the application extracts the archive through LocalFolderExtractor, insufficient path containment checks allow the crafted entry to be written outside the designated output directory. The attacker-controlled file content is then placed where the application process has filesystem write permissions. Follow-on impact depends on the destination: the attacker may overwrite configuration, place web-accessible content, tamper with files consumed by batch jobs, or prepare conditions for later code execution if another component loads or executes the written file.

How to fix it

Upgrade Junrar to version 7.5.10 or later wherever it is used, including direct dependencies, transitive dependencies, embedded JARs, shaded packages, vendor-bundled applications, and container images. If immediate upgrade is not possible, disable extraction of untrusted RAR archives, route RAR handling to a hardened sandbox, or enforce strict post-resolution path containment checks before writing any extracted file. Extraction logic should canonicalize and normalize destination paths and verify that every resolved output path remains inside the intended extraction directory. Run archive processing under a least-privilege account with write access limited to a dedicated temporary directory, and prevent extraction processes from writing to application directories, configuration paths, web roots, startup locations, or shared operational directories. Treat previously processed untrusted RAR archives as potentially unsafe until reviewed.

How to confirm the fix worked

Confirm dependency inventories, software composition analysis results, build manifests, SBOMs, Maven/Gradle dependency trees, and deployed artifacts show Junrar version 7.5.10 or later. Inspect packaged applications and containers for older junrar JARs, including shaded or repackaged copies. Functionally validate the fix by attempting to extract a benign test RAR containing traversal-style entries in a non-production test environment and confirming files are rejected, sanitized, or confined to the intended extraction directory. Review runtime permissions to ensure the extraction process cannot write outside a dedicated workspace. For exposed services, verify that RAR upload or processing endpoints either use the fixed library or reject/sandbox RAR files.

Typical attack path

1. Find an application, API, workflow, or background service that accepts or automatically processes RAR archives.
2. Confirm or infer that the service uses Junrar prior to version 7.5.10 for extraction.
3. Create a malicious RAR archive with file entries containing path traversal sequences or crafted paths that target sibling directories outside the extraction root.
4. Submit, upload, email, or otherwise deliver the crafted archive to the vulnerable processing workflow.
5. Trigger extraction of the RAR archive using the vulnerable LocalFolderExtractor implementation.
6. Write attacker-controlled content outside the intended extraction directory wherever the process has sufficient permissions.
7. Leverage the written file for tampering, persistence, web content placement, configuration manipulation, or as a prerequisite for further compromise.

How to detect it

To determine whether exploitation has already occurred, review application logs, upload logs, archive-processing logs, file integrity monitoring events, EDR telemetry, and filesystem audit logs around RAR extraction activity. Look for uploaded or processed RAR files whose internal entry names contain traversal patterns, absolute paths, encoded traversal sequences, Windows drive or UNC path indicators, or unusual sibling-directory writes. Correlate archive submissions with unexpected file creation or modification outside the configured extraction directory, especially in web roots, configuration directories, plugin directories, job/input directories, startup paths, or locations read by downstream services. If available, inspect historical extracted archive metadata, quarantine stores, temporary extraction directories, and error logs for rejected or suspicious file paths. Because this vulnerability does not have a unique network signature, detection should focus on suspicious archive entry names and unauthorized file write events by Java processes or services responsible for archive extraction.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• /../
• \\..\\
• C:\\
• file:/
• file:///
• \\\\
• LocalFolderExtractor
• junrar
• junrar-7.5.9.jar
• junrar-7.5.8.jar
• junrar-7.5.7.jar
• junrar-7.5.6.jar
• junrar-7.5.5.jar
• junrar-7.5.4.jar
• junrar-7.5.3.jar
• junrar-7.5.2.jar
• junrar-7.5.1.jar
• junrar-7.5.0.jar

What your security team should do

• Identify all applications, services, batch jobs, and third-party products that use Junrar or process RAR archives.
• Prioritize remediation for internet-facing upload portals, email or ticket attachment processors, malware scanning pipelines, document ingestion systems, and automated archive extraction workflows.
• Upgrade Junrar to version 7.5.10 or later and rebuild/redeploy affected applications and containers.
• Temporarily block or quarantine RAR archive processing from untrusted sources where upgrade cannot be completed quickly.
• Harden extraction workers with sandboxing, least-privilege filesystem access, isolated temporary directories, and deny access to application, configuration, web root, and startup paths.
• Search logs and filesystems for evidence of traversal attempts and unexpected file writes near archive extraction directories.
• Add regression tests for archive extraction path containment to prevent reintroduction of similar traversal flaws.
• Monitor dependency management feeds for downstream applications that bundle Junrar and require vendor-provided updates.