Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Junrar library can extract files outside target folder
published 1 month ago
Summary
The Junrar component used in Red Hat Lightwell may extract archive contents to locations outside the intended directory, potentially overwriting or creating unexpected files. This could allow an attacker to place malicious files on the system. Update to the Red Hat provided version to apply the fix.
What to do
- Update redhat com.github.junrar:junrar to version 7.5.5.rhlw-00001.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat Lightwell:Maven | redhat | com.github.junrar:junrar |
< 7.5.5.rhlw-00001 Fix: upgrade to 7.5.5.rhlw-00001
|
Original advisory text
Lightwell Security Advisory: junrar 7.5.5.rhlw-00001
Red Hat Lightwell has released com.github.junrar:junrar 7.5.5.rhlw-00001 with a backported security fix.
CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
This patched artifact is a drop-in replacement for com.github.junrar:junrar 7.5.5 from Maven Central.
CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
This patched artifact is a drop-in replacement for com.github.junrar:junrar 7.5.5 from Maven Central.
References
- https://github.com/junrar/junrar/releases/tag/v7.5.10 URL
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41245.json URL
- https://access.redhat.com/security/cve/CVE-2026-41245 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41245... Vendor Advisory
- https://github.com/junrar/junrar/security/advisories/GHSA-hf5p-q87m-crj7 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41245 Vendor Advisory
- https://github.com/junrar/junrar/commit/d77e9a83eb721cd51f9c23d7869d0e6ad7f952d7 Patch
- https://github.com/advisories/GHSA-hf5p-q87m-crj7 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published17 Sep 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
Track software like this
Free during beta