CVE-2026-86071

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.

• CWE-22

• https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343
• https://github.com/junrar/junrar/releases/tag/v7.6.1
• https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx

Published

Sep 16, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86062LightRAG provides simple and fast retrieval-augmented genera…6.1
• CVE-2026-86063Claude Code is an agentic coding tool. Prior to 2.1.179, the…7.5
• CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-86065Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-86066Horilla is an HR and CRM software. Prior to 2.0.0, approve_v…5.9
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6
• CVE-2026-86074n8n is an open source workflow automation platform. Prior to…7.1
• CVE-2026-86075n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-86076n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-86077n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-86078n8n is an open source workflow automation platform. Prior to…6.5