CVE-2026-86071

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.

• CWE-22

• https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343
• https://github.com/junrar/junrar/releases/tag/v7.6.1
• https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6
• CVE-2026-86074n8n is an open source workflow automation platform. Prior to…7.1
• CVE-2026-86075n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-86076n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-86077n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-86078n8n is an open source workflow automation platform. Prior to…6.5