CVE-2026-41245

The Junrar open-source Java RAR archive library is vulnerable to a path traversal (also known as Zip-Slip ) flaw in the LocalFolderExtractor component prior to version 7.5.10 . The vulnerability exists because the createDirectory() and createFile() methods validate extraction paths using a string...

CVE-2022-23596

CVE-2022-23596 affects the Junrar Java RAR archive library. A carefully crafted RAR archive can trigger an infinite loop during extraction, with impact depending on how the library is used by the application. The fix is available in version 7.4.1. Remediation: upgrade to 7.4.1 or later (no public...

CVE-2018-12418

CVE-2018-12418 affects Junrar before 1.0.1 and is triggered by processing corrupt RAR files in Archive.java, used by Apache Tika and other products. The vulnerability allows a denial-of-service via an infinite loop, with the root cause in Archive.java. In practice, exploitation could occur when a...

CVE-2026-28208

Summary: Junrar is an open-source Java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on L...