CVE-2026-28208: 
Java vulnerability analysis and mitigation

CVE-2026-28208 is a backslash path traversal vulnerability in Junrar, an open-source Java RAR archive library, affecting all versions prior to 7.5.8. The flaw resides in the LocalFolderExtractor component and allows an attacker to write arbitrary files with attacker-controlled content anywhere on the Linux/Unix filesystem when a crafted RAR archive is extracted. It was disclosed on February 26, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The createFile() method in LocalFolderExtractor.java validates extraction paths using getCanonicalPath().startsWith() to ensure files remain within the destination directory. On Linux/Unix, backslashes are treated as literal filename characters rather than path separators, so a RAR entry named ..\..\tmp\evil.txt passes the startsWith check because getCanonicalPath() does not resolve the .. components. However, the makeFile() method subsequently splits the filename on backslashes (name.split("\\\\")) and reconstructs the path using the platform's file separator (/), converting the literal backslashes into real directory traversal sequences (e.g., ../../tmp/evil.txt). The extract() method then opens a FileOutputStream on this resolved path and writes the RAR entry's content, achieving arbitrary file write outside the extraction directory. Windows systems are not affected because backslashes are path separators there, causing getCanonicalPath() to correctly resolve and block the traversal (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker (given network access to a service that processes user-supplied RAR archives) to write arbitrary attacker-controlled content to any location on the Linux/Unix filesystem accessible by the Java process. This can lead to remote code execution by overwriting sensitive files such as shell profiles (.bashrc, .profile), cron jobs, application source code, or other executable scripts. Confidentiality is not directly impacted, but integrity is severely compromised, and the potential for full system takeover is high in environments where the application runs with elevated privileges (Github Advisory).

A public proof-of-concept exploit is available in the GitHub security advisory, including a complete setup script (poc_setup.sh) and Java PoC class that demonstrates overwriting /tmp/existing-file using the standard Junrar.extract() API. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.137–0.211% (44th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory).

1. Craft a malicious RAR archive: Create a RAR3 archive containing a file entry whose name uses backslash-separated .. components (e.g., ..\..\tmp\target-file). On Linux, this name is treated as a literal string by getCanonicalPath(), bypassing the path validation check. The PoC uses Python's struct and zlib modules to construct a valid RAR3 binary with this crafted entry name and attacker-controlled file content.
2. Deliver the archive to the target: Distribute the malicious RAR file to a system or application that uses Junrar (versions < 7.5.8) to extract user-supplied archives. This may involve social engineering, uploading to a file-processing service, or any other vector that causes the application to call Junrar.extract() on the crafted archive.
3. Trigger extraction: Cause the target application to extract the malicious RAR archive using the standard Junrar.extract(archive, destinationDir) API call. No special privileges or authentication are required beyond the ability to supply the archive.
4. Achieve arbitrary file write: The makeFile() method splits the entry name on backslashes and reconstructs the path with / as the separator, resolving ..\..\tmp\target-file to ../../tmp/target-file relative to the extraction directory. A FileOutputStream is opened on this path and the attacker's content is written.
5. Escalate to RCE: By targeting files such as ~/.bashrc, ~/.profile, cron job scripts, or application source files, the attacker can achieve code execution the next time the overwritten file is invoked by the system or a user (Github Advisory).

• File System: Unexpected modification timestamps on shell profile files (e.g., ~/.bashrc, ~/.profile, /etc/profile), cron job files, or application source/script files; presence of files with unusual content in directories outside the intended RAR extraction path.
• Logs: Application logs showing RAR extraction activity followed by unexpected file write errors or IllegalStateException messages containing "Rar contains file with invalid path" (if a patched version partially processes the archive); Java process logs indicating FileOutputStream writes to paths outside the extraction directory.
• Process: Unexpected execution of shell commands or scripts shortly after a RAR extraction event; unusual child processes spawned by the Java application process (e.g., /bin/bash, curl, wget).
• Network: Inbound delivery of RAR archives to file-processing endpoints from untrusted or external sources; outbound connections from the Java application process to unknown external hosts following archive extraction.

Upgrade Junrar to version 7.5.8 or later, which fixes the issue by normalizing backslashes to forward slashes via invariantSeparatorsPathString() before path validation, and by changing makeFile() to split on / instead of \\ (Patch Commit, Release v7.5.8). Until patching is complete, restrict RAR archive extraction to trusted sources only and avoid processing user-supplied RAR files. Additionally, apply the principle of least privilege to the Java process performing extraction to limit the blast radius of any arbitrary file write, and implement file integrity monitoring on critical system files and application directories (Github Advisory).