CVE-2026-28208: Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

February 27, 2026

A backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc).

References

github.com/advisories/GHSA-j273-m5qq-6825
github.com/junrar/junrar
github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954
github.com/junrar/junrar/releases/tag/v7.5.8
github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825
nvd.nist.gov/vuln/detail/CVE-2026-28208

Code Behaviors & Features

Detect and mitigate CVE-2026-28208 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →