CVE-2026-28208

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

• CWE-22

• https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954Patch
• https://github.com/junrar/junrar/releases/tag/v7.5.8Product, Release Notes
• https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825Exploit, Vendor Advisory
• https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825Exploit, Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28196In JetBrains TeamCity before 2025.11.3 disabling versioned s…2.3
• CVE-2026-2820A security flaw has been discovered in Fujian Smart Integrat…7.3
• CVE-2026-28201An improper input validation, together with an overly permis…7.8
• CVE-2026-28204Charging station authentication identifiers are publicly acc…6.9
• CVE-2026-28205OpenPLC_V3 is vulnerable to an Initialization of a Resource …9.8
• CVE-2026-28207Zen C is a systems programming language that compiles to hum…7.3
• CVE-2026-28209FreePBX is an open source IP PBX. From versions 16.0.17.2 to…7.2
• CVE-2026-2821A weakness has been identified in Fujian Smart Integrated Ma…7.3
• CVE-2026-28210FreePBX is an open source IP PBX. Prior to versions 16.0.49 …8.8
• CVE-2026-28211The NVDA Dev & Test Toolbox is an NVDA add-on for gathering …7.8
• CVE-2026-28212Firebird is an open-source relational database management sy…7.5
• CVE-2026-28213EverShop is a TypeScript-first eCommerce platform. Versions …9.8