CVE-2026-28208Disclosure(junrar_project / junrar)

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

junrar_project CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954

Exploit / PoC references

Other references

https://github.com/junrar/junrar/releases/tag/v7.5.8

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

junrar

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-02-27); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

junrar_project

Products

junrar

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-27	3	Disclosure3
2026-04-17	1	Disclosure1

Full discourse4 posts

DailyCVE@dailycve175d
Disclosure
🟠 Junrar (#Java), Path Traversal (Zip-Slip), #CVE-2026-28208 (Moderate) https://dailycve.com/junrar-java-path-traversal-zip-slip-cve-2026-28208-moderate/
Post summary
A moderate‑risk path traversal vulnerability (Zip‑Slip) in Junrar Java (CVE‑2026‑28208) has been publicly disclosed.
0000090
181 followersView on X
cvereports@_cvereports223d
Disclosure
CVE-2026-28208: Junrar Path Traversal: Arbitrary File Write via Backslash Confusion A path traversal vulnerability in the Junrar Java library allows attackers to overwrite arbitrary files on Linux and Unix systems. The flaw arises from a semantic disc... https://cvereports.com/reports/CVE-2026-28208
Post summary
The text announces CVE‑2026‑28208, a Junrar path traversal flaw that permits arbitrary file writes on Linux/Unix systems via backslash confusion, without indicating exploitation, patches, or a PoC.
0000049
32 followersView on X
CVE@CVEnew223d
Disclosure
CVE-2026-28208 Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to wr… https://www.cve.org/CVERecord?id=CVE-2026-28208
Post summary
Junrar versions prior to 7.5.8 contain a backslash path traversal vulnerability (CVE‑2026‑28208) in LocalFolderExtractor; no PoC, exploit, or patch details are provided.
00000137
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds224d
Disclosure
CVE-2026-28208 Junrar Path Traversal Vulnerability Allows Arbitrary File Write on Linux/Unix Systems https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28208
Post summary
The post announces a path traversal flaw in Junrar that permits arbitrary file writes on Linux/Unix systems, but it offers no PoC, exploit code, patch, or evidence of active exploitation.
0000037
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	junrar_project	junrar	-	-	-

Explore more

Back to dashboard junrar_project CVEs junrar vulnerabilities

What researchers are saying

CVE-2026-28208

DailyCVE@dailycveDisclosure

A moderate‑risk path traversal vulnerability (Zip‑Slip) in Junrar Java (CVE‑2026‑28208) has been publicly disclosed.

cvereports@_cvereportsDisclosure

The text announces CVE‑2026‑28208, a Junrar path traversal flaw that permits arbitrary file writes on Linux/Unix systems via backslash confusion, without indicating exploitation, patches, or a PoC.

CVE@CVEnewDisclosure

Junrar versions prior to 7.5.8 contain a backslash path traversal vulnerability (CVE‑2026‑28208) in LocalFolderExtractor; no PoC, exploit, or patch details are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a path traversal flaw in Junrar that permits arbitrary file writes on Linux/Unix systems, but it offers no PoC, exploit code, patch, or evidence of active exploitation.