CVE-2026-41245: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Synopsis

A path traversal (Zip-Slip) vulnerability exists in the Junrar Java RAR archive library, affecting all versions prior to 7.5.10. The flaw is reachable over the network and requires no authentication, but does require a victim to extract a crafted RAR archive supplied by the attacker. Successful exploitation lets the attacker write arbitrary files with attacker-controlled content into directories outside the intended extraction path, enabling both data tampering and denial of service. HarborGuard is tracking the advisory for patch availability, as no fix version has been published upstream at this time.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted RAR archive over the network, exposing any service or workflow that fetches and extracts remote or user-supplied archives.

• AuthenticationNot required

  No credentials are needed; the attacker only needs to get the victim to extract a malicious archive, with no account or session required.

• Victim interactionRequired

  A user or automated process must explicitly extract the attacker-crafted RAR archive, making this a social-engineering or supply-chain delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge.

Blast Radius

• The attacker writes arbitrary files with attacker-controlled content to sibling directories outside the intended extraction root, overwriting configuration files, scripts, or application binaries.
• Overwriting executable or configuration files can cause the affected service or application to crash or behave incorrectly, disrupting availability.
• Because the scope is changed (S:C in the CVSS vector), files written by the exploit can affect components beyond the extracting process itself, including co-located services sharing the filesystem.
• No confidential data is directly read by this exploit; the primary impact is unauthorized file writes and the resulting service disruption.