Security readout for executives and security teams
Plain-English summary
Junrar versions before 7.5.10 can let a malicious RAR archive place files outside the intended extraction folder, specifically into sibling directories. If a business process extracts untrusted RAR files, an attacker could overwrite or plant files and disrupt systems or alter application behavior.
Executive priority
Treat as urgent where Junrar processes external or partner-supplied archives. Prioritize internet-facing upload and ingestion systems first, then internal automation. Systems that do not extract untrusted RAR files have lower practical urgency.
Technical view
CVE-2026-41245 is a CWE-22 path traversal in Junrar LocalFolderExtractor. The source bundle describes a Zip-Slip style flaw where crafted archive paths bypass intended directory boundaries via sibling directory name prefixes. Junrar 7.5.10 fixes the issue. CVSS is 9.3 critical with high integrity and availability impact.
Likely exposure
Exposure applies to Java applications or backend workflows using junrar below 7.5.10 to extract attacker-controlled RAR archives. Likely locations include upload processing, content ingestion, email attachment handling, document pipelines, and automated archive unpacking jobs.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires a crafted RAR archive to be extracted by a vulnerable application or workflow, so risk depends on whether untrusted archives reach Junrar extraction paths.
Researcher notes
The evidence identifies upstream Junrar before 7.5.10 and a fixed release. The bundle does not provide exploit code, active exploitation confirmation, or detailed downstream Red Hat impact. Validate dependency reachability before declaring business exposure.
Mitigation direction
- Upgrade junrar to version 7.5.10 or later.
- Identify and patch transitive junrar dependencies in Java builds.
- Restrict or pause extraction of untrusted RAR files until upgraded.
- Ensure extraction output directories are isolated from application and system paths.
- Check upstream and Red Hat guidance for downstream package status.
Validation and detection
- Search SBOMs and dependency manifests for junrar versions below 7.5.10.
- Confirm production runtime artifacts include the fixed junrar version.
- Review upload and ingestion workflows for untrusted RAR extraction.
- Verify extraction outputs cannot affect application, web, or operational directories.
- Monitor vendor advisories for downstream distribution impact.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-41245 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H2.85.8redhat-SADPCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N2.23.6GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-20T16:01:18.840Z: Reported to Red Hat.
- 2026-04-20T15:15:24.540Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/junrar/junrar/security/advisories/GHSA-hf5p-q87m-crj7CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/junrar/junrar/commit/d77e9a83eb721cd51f9c23d7869d0e6ad7f952d7CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/junrar/junrar/releases/tag/v7.5.10CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-41245CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2459769CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41245.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.