{"uuid": "46d32ada-2fe0-4310-ae10-eed99e24835d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86071", "type": "seen", "source": "https://gist.github.com/alon710/697691f7d78bb4a6dd022b9c35afe5f3", "content": "# CVE-2026-86071: CVE-2026-86071: Path Traversal Vulnerability in Junrar Archive Library\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86071\n\n## Summary\nA directory traversal vulnerability exists in the Junrar archive extraction library prior to version 7.6.1. When extracting crafted RAR archives, the library allows unauthorized directory creation outside the designated destination root due to improper path normalization during directory creation.\n\n## TL;DR\nJunrar versions before 7.6.1 are vulnerable to a directory traversal flaw allowing unauthorized directory creation via crafted archive entries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 3.7 (Low)\n- **Exploit Status**: PoC (Proof of Concept)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Junrar Java archive library versions prior to 7.6.1\n- **Junrar**: < 7.6.1 (Fixed in: `7.6.1`)\n\n## Mitigation\n\n- Upgrade Junrar dependency to version 7.6.1\n- Sanitize and reject archive entry paths containing relative traversal sequences\n\n**Remediation Steps:**\n1. Identify any applications utilizing the Junrar library\n2. Update the Maven dependency coordinates to version 7.6.1\n3. Deploy the updated application to production environment\n4. Implement a custom pre-extraction validation step to reject paths containing path traversal components if upgrade is delayed\n\n## References\n\n- [GitHub Security Advisory GHSA-89m4-43j5-vhhx](https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx)\n- [Junrar v7.6.1 Release Notes](https://github.com/junrar/junrar/releases/tag/v7.6.1)\n- [Remediation Commit](https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86071) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T17:31:17.484781Z"}