CVE-2026-41245

Name of the Vulnerable Software and Affected Versions Junrar versions prior to 7.5.10

Description A path traversal flaw in the LocalFolderExtractor allows a remote attacker to write arbitrary files with attacker-controlled content into sibling directories during the extraction of a specially crafted RAR archive. This occurs because the createDirectory() and createFile() functions in LocalFolderExtractor validate extraction paths using a string prefix, which can be bypassed to create or modify files outside the intended extraction path.

Recommendations Update to version 7.5.10.