CVE-2026-28208: Junrar Path Traversal Vulnerability

CVE-2026-28208 Overview

Junrar is an open source Java RAR archive library that contains a critical path traversal vulnerability prior to version 7.5.8. A backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix systems. This vulnerability can lead to remote code execution through various attack vectors such as overwriting shell profiles, source code, or cron jobs.

Critical Impact

Attackers can achieve arbitrary file write capabilities on affected Linux/Unix systems, potentially leading to remote code execution by overwriting critical system files, shell configurations, or scheduled task definitions.

Affected Products

• Junrar versions prior to 7.5.8
• Applications and services utilizing vulnerable Junrar library for RAR archive extraction
• Java-based systems on Linux/Unix platforms processing untrusted RAR archives

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-28208 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28208

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the LocalFolderExtractor class of the Junrar library. The vulnerability stems from improper handling of backslash characters in file paths within RAR archives. When processing archives on Linux/Unix systems, the library fails to properly normalize path separators, allowing attackers to craft malicious archive entries that escape the intended extraction directory.

The attack requires crafting a RAR archive with specially constructed file paths containing backslash sequences that, when extracted, resolve to locations outside the designated extraction folder. While the library had existing path traversal protections using canonical path validation, the backslash handling gap allowed these protections to be bypassed.

Root Cause

The root cause lies in the createFile method within LocalFolderExtractor.java. The method retrieves the filename from the FileHeader object directly without first normalizing path separators to a consistent format. On Unix-based systems, backslashes are valid characters in filenames but can be interpreted differently during path resolution, allowing the canonical path check to be bypassed.

Attack Vector

The attack vector is network-based with high attack complexity. An attacker must craft a malicious RAR archive and convince a victim application to extract it, or exploit a service that automatically processes RAR files. The attacker-controlled file paths within the archive allow writing arbitrary content to any location accessible by the extracting process.

// Security patch from LocalFolderExtractor.java
// Source: https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954

     }
 
     private File createFile(final FileHeader fh, final File destination) throws IOException {
-        String name = fh.getFileName();
+        String name = invariantSeparatorsPathString(fh.getFileName());
         File f = new File(destination, name);
         String dirCanonPath = f.getCanonicalPath();
         if (!dirCanonPath.startsWith(destination.getCanonicalPath())) {

The fix introduces invariantSeparatorsPathString() to normalize all path separators before the canonical path validation check, ensuring backslashes are properly converted and cannot bypass the directory escape protection.

Detection Methods for CVE-2026-28208

Indicators of Compromise

• Unexpected file creation or modification outside designated extraction directories
• RAR archive files containing entries with backslash characters in filenames
• Modification of critical system files such as .bashrc, .profile, or crontab entries following RAR extraction operations
• Suspicious Java process activity involving Junrar library with file writes to sensitive paths

Detection Strategies

• Monitor file system activity for writes outside expected extraction directories during archive processing operations
• Implement application-level logging to track RAR extraction activities and destination paths
• Scan inbound RAR archives for suspicious path patterns containing backslash sequences targeting parent directories
• Deploy endpoint detection rules that alert on unexpected modifications to shell profiles and cron configurations

Monitoring Recommendations

• Enable file integrity monitoring on critical system configuration files and directories
• Log all RAR archive extraction operations with source archive hashes and destination paths
• Monitor for Junrar library usage in applications and track version deployments across your environment
• Implement network-level inspection for RAR files with anomalous internal path structures

How to Mitigate CVE-2026-28208

Immediate Actions Required

• Upgrade Junrar library to version 7.5.8 or later immediately
• Audit applications and services that utilize Junrar for RAR archive extraction
• Review extracted file locations for signs of compromise or unexpected file placements
• Implement additional path validation at the application level as defense-in-depth

Patch Information

The vulnerability has been addressed in Junrar version 7.5.8. The fix normalizes path separators using the invariantSeparatorsPathString() method before performing canonical path validation, ensuring consistent handling regardless of the separator characters used in archive entries.

For detailed patch information, see the GitHub Security Advisory GHSA-j273-m5qq-6825 and the GitHub Release v7.5.8.

Workarounds

• Restrict RAR archive processing to trusted sources only until patching is complete
• Implement application-level path validation that normalizes separators before extraction
• Run RAR extraction processes with minimal filesystem permissions in isolated environments
• Use containerization or chroot environments to limit the blast radius of potential exploitation

# Maven dependency update for Junrar
# Update pom.xml to use patched version 7.5.8 or later
<dependency>
    <groupId>com.github.junrar</groupId>
    <artifactId>junrar</artifactId>
    <version>7.5.8</version>
</dependency>