VulnerableCode Package Details - pkg:maven/com.github.junrar/junrar@7.5.8

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/com.github.junrar/junrar@7.5.8

Essentials

purl	pkg:maven/com.github.junrar/junrar@7.5.8

Next non-vulnerable version	7.6.1
Latest non-vulnerable version	7.6.1
Risk score	3.4

Vulnerabilities affecting this package (3)

Advisory	Summary	Fixed in package version
GHSA-hf5p-q87m-crj7 Aliases: CVE-2026-41245	Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix ### Summary A path traversal vulnerability in `LocalFolderExtractor` allows an attacker …	7.5.10 Vulnerable
GHSA-89m4-43j5-vhhx Aliases: CVE-2026-86071	Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root ## Summary `LocalFolderExtractor` validates only the final canonical file path …	7.6.1 Not vulnerable
GHSA-h9h9-2rmf-rvhp Aliases: CVE-2026-97370	Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction ### Summary Junrar's RAR virtual machine can be …	7.6.1 Not vulnerable

Vulnerabilities fixed by this package (1)

Advisory	Summary	Aliases
GHSA-j273-m5qq-6825	Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix ### Summary A backslash …	CVE-2026-28208