unrar-cve-2022-30333-poc

一个针对 CVE-2022-30333 的概念验证——这是 unRAR 6.11 之前版本中的一个路径遍历漏洞。我编写此工具是为了在 AttackerKB 的讨论中演示该漏洞的利用方式，并计划尽快将其整合进 Metasploit 模块中！ 基本上，你只需提供一个目标路径（包括路径遍历）和某些文件数据，此工具就会生成一个 .rar 文件，该文件在解压时会将指定数据写入目标位置。文件名最大长度为 104 字节，文件数据最大长度为 4096 字节。（这并非漏洞本身限制，只是我在生成文件时设定的参数）。 例如，使用 msfvenom 生成一个后门： root@kitploit: $ msfven...

CVE-2022-30333

CVE-2022-30333（unRARバージョン6.11より前のパストラバーサル脆弱性）の概念実証です。AttackerKBの記事向けにエクスプロイトのデモとして作成し、近いうちにMetasploitモジュールに組み込む予定です！ 基本的には、ターゲット（パストラバーサルを含む）とファイルデータを指定すると、このツールがその場所にファイルを展開する.rarファイルを生成します。最大ファイル長は104バイト、最大ファイル長は4096バイトです。（これは脆弱性に固有のものではなく、ファイル生成時に私が選択したものです）。 例えば、msfvenom でバックドアを生成します：...

Zimbra-CVE-2022-30333

Zimbra-CVE-2022-30333 Zimbra unrar漏洞。目前已有POC发布，因此公开我们的POC是安全的。 CVE-2022-30333 Zimbra UNRAR漏洞。Unrar直到V 6.11版本都存在漏洞。确保你的.jsp webshell未被检测到。该漏洞利用仅适用于安装在默认路径下的Zimbra。 将你的webshell放入rootver文件夹。删除现有的shell.jsp文件。然后将rootver文件夹压缩为rar格式。注意是rar，不是zip。接着运行 python CVE-2022-30333.py rootver.rar...

EUVD-2025-210497

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

PT-2026-63494

Name of the Vulnerable Software and Affected Versions IZArc version 4.6 Description An issue in the unrar.dll component allows attackers to perform path traversal, a technique used to access files and directories that are stored outside the intended folder. Recommendations At the moment, there is...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

CVE-2025-60835

CVE-2025-60835 concerns IZArc v4.6, specifically the unrar.dll component, where a path traversal flaw could allow an attacker to access files via crafted input. The connected sources consistently state a path-traversal vulnerability in unrar.dll but do not provide detailed exploit steps, affected...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

The vulnerability of the RAR5 file archiver WinRAR’s recovery processing system and the UnRAR decompression tool allows a perpetrator to execute arbitrary code.

The vulnerability of the RAR5 file archiver WinRAR’s volume recovery processing system, as well as the UnRAR decompression tool, is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2017-12941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function. CVE-2017-12941 Note that Nessus relies on the presence of the packa...

CVE-2026-14191

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB’s UnRAR version prior to 6.12 on Linux and UNIX allowed directory traversal, enabling writing to files during an extraction operation also known as unpacking. This was demonstrated by creating a file named /.ssh/authorizedkeys. NOTE: WinRAR and Android RAR are not affected by this issue...

Astra Linux – Vulnerability in unrar-nonfree

UnRAR before version 6.2.3 allowed extraction of files outside of the destination folder using symlink chains...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB WinRAR Recovery Volume: Improper validation of array index leads to remote code execution vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability, as the targe...

SUSE CVE-2026-24857

bulkextractor is a digital forensics exploitation tool. Starting in version 1.4, bulkextractor's embedded unrar code has a heap-buffer-overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out-of-bounds write in Unpack::CopyString, leading to a crash under ASAN and...

EUVD-2026-4855

bulkextractor is a digital forensics exploitation tool. Starting in version 1.4, bulkextractor’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out‑of‑bounds write in Unpack::CopyString, leading to a crash under ASAN and...

CVE-2026-24857

CVE-2026-24857 affects bulk_extractor (bulk extractor). Starting in version 1.4, the embedded unrar code has a heap-buffer-overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image can trigger an out-of-bounds write in Unpack::CopyString, causing a crash under ASAN and likely me...

Building bulk_extractor security vulnerabilities

Building bulkextractor is a high-performance digital forensics analysis tool developed by Simson L. Garfinkel. Versions of Building bulkextractor 1.4 and later contain security vulnerabilities. These vulnerabilities stem from an overflow in the heap buffer in the embedded unrar code’s RAR PPM LZ...

PT-2026-5229

Name of the Vulnerable Software and Affected Versions bulk extractor versions 1.4 and later Description bulk extractor is a digital forensics exploitation tool. The embedded unrar code within bulk extractor, starting with version 1.4, contains a heap-buffer-overflow in the RAR PPM LZ decoding pat...