Security readout for executives and security teams
Plain-English summary
Applications using vulnerable Junrar versions can let a crafted RAR archive overwrite or create files in nearby directories during extraction. An attacker must persuade a system or user to extract the archive. The resulting file writes could damage applications or disrupt services, although the supplied sources do not report confidentiality impact.
Executive priority
Prioritize rapid remediation for internet-facing upload, email-processing, or automated archive-extraction systems. Other deployments should still upgrade promptly after confirming exposure. The critical score reflects potentially severe file integrity and service availability consequences, but there is no supplied evidence of active exploitation.
Technical view
Junrar versions before 7.5.10 contain a CWE-22 path traversal flaw in LocalFolderExtractor. A crafted archive can escape the intended extraction directory into sibling directories whose names share a prefix. The CVSS 3.1 score is 9.3, reflecting network delivery, low complexity, no privileges, required user interaction, changed scope, and high integrity and availability impact.
Likely exposure
Exposure is most likely where Java applications use Junrar below 7.5.10, invoke LocalFolderExtractor, and extract untrusted or externally supplied RAR files. Risk depends on the extraction process's filesystem permissions and the presence of writable sibling directories. The bundle supplies no CPEs or deployment prevalence data.
Exploitation context
The crafted archive must be extracted, so exploitation requires user or application interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Public technical references include the corrective commit, but exploitation prevalence and proof-of-concept availability are not established here.
Researcher notes
The distinguishing condition is escape into sibling directories through a name-prefix relationship, rather than unrestricted traversal to every filesystem location. Assessment should examine canonical path containment and sibling naming around extraction roots. The supplied commit and advisory are the primary references for patch-level analysis; no exploit status should be inferred from their publication.
Mitigation direction
- Upgrade Junrar to version 7.5.10 or later.
- Identify and update vulnerable transitive dependencies as well as direct Junrar dependencies.
- Until upgraded, avoid extracting untrusted RAR archives with affected applications.
- Restrict the extraction process's write permissions and isolate its output directory.
- Review the vendor advisory and release notes before deployment.
Validation and detection
- Confirm deployed Junrar versions are 7.5.10 or later.
- Search dependency manifests and resolved dependency trees for older Junrar versions.
- Identify code paths that use LocalFolderExtractor on externally supplied archives.
- Verify extraction services cannot write into sensitive sibling directories.
- Test the upgraded application against normal archive extraction workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-41245 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H2.85.8redhat-SADPCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N2.23.6GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-20T16:01:18.840Z: Reported to Red Hat.
- 2026-04-20T15:15:24.540Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/junrar/junrar/security/advisories/GHSA-hf5p-q87m-crj7CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/junrar/junrar/commit/d77e9a83eb721cd51f9c23d7869d0e6ad7f952d7CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/junrar/junrar/releases/tag/v7.5.10CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-41245CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2459769CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41245.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.