Vulnerability Description
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343
- https://github.com/junrar/junrar/releases/tag/v7.6.1
- https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx
FAQ
What is CVE-2026-86071?
CVE-2026-86071 is a vulnerability with a CVSS score of 3.7 (LOW). Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended...
How severe is CVE-2026-86071?
CVE-2026-86071 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86071?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.