CVE-2022-30333

CVE-2022-30333 的概念验证——unRAR 6.11 之前版本中的一个路径遍历漏洞。我创建这个工具是为了在 AttackerKB 的分析文章中演示该漏洞，并希望尽快将其整合到 Metasploit 模块中！ 基本上，你提供一个目标路径（包含路径遍历）和一些文件数据，这个工具会生成一个 .rar 文件，解压时会将文件提取到指定位置。最大文件长度为 104 字节，文件内容最大为 4096 字节。（这不是漏洞本身的限制，只是我生成文件时选择的数值）。 例如，使用 msfvenom 生成一个后门： root@kitploit: $ msfvenom -p...

CVE-2022-30333-PoC

CVE-2022-30333-POC CVE-2022-30333 をテストするためのサンプルファイル Sample.rar : Linux でテストしたい場合。展開すると、../../tmp/traversed に trav が作成されます。Sample.rar を展開する前に、ディレクトリ ../../tmp/traversed が存在することを確認してください。 exp.rar : Zimbra Mail サーバでテストしたい場合。展開すると、/opt/zimbra/jettybase/webapps/zimbra/public/ に moo.txt が作成されます。このファイルに...

Zimbra-CVE-2022-30333

Zimbra-CVE-2022-30333 Zimbra の unrar 脆弱性。現在すでに POC が公開されているため、当方の POC を公開しても安全です。 CVE-2022-30333 Zimbra UNRAR の脆弱性。V 6.11 までの Unrar が脆弱です。.jsp シェルが検出されないようにしてください。このエクスプロイトは、デフォルトパスにインストールされた Zimbra で動作します。 webshell を rootver フォルダに配置してください。既存の shell.jsp ファイルを削除してください。次に rootver フォルダを rar...

unrar-cve-2022-30333-poc

CVE-2022-30333 の概念実証 - unRAR バージョン 6.11 未満におけるパストラバーサル脆弱性です。AttackerKB の記事向けにエクスプロイトのデモとして作成し、近々 Metasploit モジュールに組み込む予定です。 基本的には、ターゲット（パストラバーサルを含む）とファイルデータを指定すると、そのファイルを指定された場所に展開する .rar ファイルを生成します。最大ファイル長は 104 バイト、最大ファイルサイズは 4096 バイトです。（これは脆弱性に固有の制限ではなく、ファイルを生成する際に私が設定した値です。） 例えば、msfvenom...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB’s UnRAR version prior to 6.12 on Linux and UNIX allowed directory traversal, enabling writing to files during an extraction operation also known as unpacking. This was demonstrated by creating a file named /.ssh/authorizedkeys. NOTE: WinRAR and Android RAR are not affected by this issue...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB WinRAR Recovery Volume: Improper validation of array index leads to remote code execution vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability, as the targe...

EUVD-2025-210497

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

PT-2026-63494

Name of the Vulnerable Software and Affected Versions IZArc version 4.6 Description An issue in the unrar.dll component allows attackers to perform path traversal, a technique used to access files and directories that are stored outside the intended folder. Recommendations At the moment, there is...

CVE-2025-60835

CVE-2025-60835 concerns IZArc v4.6, specifically the unrar.dll component, where a path traversal flaw could allow an attacker to access files via crafted input. The connected sources consistently state a path-traversal vulnerability in unrar.dll but do not provide detailed exploit steps, affected...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

The vulnerability of the RAR5 file archiver WinRAR’s recovery processing system and the UnRAR decompression tool allows a perpetrator to execute arbitrary code.

The vulnerability of the RAR5 file archiver WinRAR’s volume recovery processing system, as well as the UnRAR decompression tool, is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2017-12941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function. CVE-2017-12941 Note that Nessus relies on the presence of the packa...

DEBIAN-CVE-2026-14191

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

CVE-2026-14191

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

Astra Linux – Vulnerability in unrar-nonfree

UnRAR before version 6.2.3 allowed extraction of files outside of the destination folder using symlink chains...

SUSE CVE-2026-24857

bulkextractor is a digital forensics exploitation tool. Starting in version 1.4, bulkextractor's embedded unrar code has a heap-buffer-overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out-of-bounds write in Unpack::CopyString, leading to a crash under ASAN and...

EUVD-2026-4855

bulkextractor is a digital forensics exploitation tool. Starting in version 1.4, bulkextractor’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out‑of‑bounds write in Unpack::CopyString, leading to a crash under ASAN and...

CVE-2026-24857

CVE-2026-24857 affects bulk_extractor (bulk extractor). Starting in version 1.4, the embedded unrar code has a heap-buffer-overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image can trigger an out-of-bounds write in Unpack::CopyString, causing a crash under ASAN and likely me...