CVE-2026-86071: Junrar Path Traversal Vulnerability

CVE-2026-86071 Overview

CVE-2026-86071 is a path traversal vulnerability [CWE-22] in Junrar, an open source Java library for reading RAR archives. Versions prior to 7.6.1 allow a crafted archive entry to trigger directory creation outside the intended extraction root. The flaw resides in LocalFolderExtractor under src/main/java/com/github/junrar/LocalFolderExtractor.java, where createFile() validates only the final canonical file path while makeFile() creates intermediate path segments through unchecked mkdir() calls. The demonstrated impact is unauthorized directory creation, enabling filesystem pollution or file-versus-directory squatting that can cause later security-sensitive writes to fail. The issue is fixed in Junrar version 7.6.1.

Critical Impact
A malicious RAR archive can create directories outside the extraction target, polluting the filesystem and enabling squatting attacks against sensitive write paths.

Affected Products

Junrar versions prior to 7.6.1
Java applications embedding Junrar for RAR archive extraction
Downstream projects using LocalFolderExtractor for archive handling

Discovery Timeline

2026-09-16 - CVE-2026-86071 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86071

Vulnerability Analysis

Junrar's LocalFolderExtractor class implements RAR extraction to a local directory. During extraction, createFile() computes the canonical path of the final destination file and rejects entries whose resolved path escapes the target root. This check catches the terminal file location but ignores the intermediate directories created along the way.

The helper makeFile() walks each path segment of the archive entry and invokes mkdir() without validating that each segment remains inside the extraction root. An attacker who crafts an entry whose intermediate segments contain traversal sequences can therefore create directories anywhere the running process has write permissions, even though the final file lands inside the destination directory.

The practical impact is filesystem pollution and squatting. An attacker can pre-create directories at paths that a later security-sensitive operation expects to create as files, causing that operation to fail or behave unexpectedly. The advisory explicitly limits the demonstrated impact to directory creation, not arbitrary file-content write.

Root Cause

The root cause is inconsistent path validation. Only the final canonical file path is validated against the extraction root, while intermediate mkdir() calls in makeFile() operate on untrusted, unvalidated path segments derived from archive entry names.

Attack Vector

Exploitation requires the victim application to extract an attacker-controlled RAR archive using a vulnerable Junrar version. The attacker crafts an entry whose path contains traversal components (..) in intermediate segments while resolving the final component back inside the destination directory. On extraction, the intermediate mkdir() calls create directories outside the intended root.

java

// Fix applied in LocalFolderExtractor.java (v7.6.1)
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
 
 class LocalFolderExtractor {
// Source: https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343

The patch introduces java.nio.file APIs so that intermediate path creation can be validated against the target directory rather than relying on raw File.mkdir() calls. See the GitHub Security Advisory GHSA-89m4-43j5-vhhx for full details.

Detection Methods for CVE-2026-86071

Indicators of Compromise

Unexpected directories created outside the application's designated extraction or working directory following RAR archive processing.
RAR archive entries whose internal paths contain .. sequences in intermediate path segments.
Application errors from downstream write operations failing because a target path exists as a directory rather than a file.

Detection Strategies

Perform software composition analysis (SCA) to identify Java applications and services that bundle com.github.junrar:junrar at versions below 7.6.1.
Inspect incoming RAR archives with a pre-extraction linter that rejects entries containing traversal characters in any path segment.
Review application logs from Junrar-based extraction workflows for entries whose resolved paths differ from the archive-declared entry names.

Monitoring Recommendations

Monitor filesystem activity on hosts that extract user-supplied archives, alerting on directory creations outside the designated extraction root.
Track dependency inventories in CI/CD to flag any build that reintroduces a Junrar version earlier than 7.6.1.
Correlate archive-processing events with unexpected mkdir operations by the application's service account.

How to Mitigate CVE-2026-86071

Immediate Actions Required

Upgrade Junrar to version 7.6.1 or later in all applications and container images that process RAR archives.
Audit build manifests (pom.xml, build.gradle) for transitive Junrar dependencies and pin them to the patched release.
Restrict the filesystem permissions of processes that extract untrusted archives so that any directory creation is confined to a dedicated sandbox.

Patch Information

The fix is available in Junrar 7.6.1. See the GitHub Release v7.6.1 and the underlying GitHub Commit e6e333b which introduces java.nio.file based path handling in LocalFolderExtractor.

Workarounds

Extract RAR archives inside an isolated, disposable directory (for example, a per-request temporary directory) that is discarded after use.
Pre-validate archive entry names and reject any entry whose path contains .. or absolute path components before invoking Junrar.
Run archive extraction under a least-privileged service account with no write access outside the intended extraction root.

bash

# Enforce patched Junrar version in Maven builds
mvn dependency:tree | grep junrar
# Ensure output shows com.github.junrar:junrar:7.6.1 or later