CVE-2026-86071

Name of the Vulnerable Software and Affected Versions Junrar versions prior to 7.6.1

Description An extraction root escape exists when processing crafted archive entries. The createFile() function validates only the final canonical file path, but the makeFile() function creates intermediate path segments using unchecked mkdir() calls. This allows a malicious entry to ensure the final path resolves inside the destination while creating intermediate directories outside the intended extraction root. This can lead to filesystem pollution or file-versus-directory squatting, where a directory is created at a path where a security-sensitive file is expected, causing subsequent writes to fail. The impact is limited to directory creation rather than arbitrary file-content writes.

Recommendations Update Junrar to version 7.6.1.