Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.github.junrar:junrar

6 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
8.1.2 (Oct 9, 2026): no advisory affects it
Newest unaffected release
8.1.2 (Oct 9, 2026), the latest release
Advisories
6 · 2 high, 2 medium, 1 low
Dependents
11
Releases
33 since 0.7 (Sep 5, 2012)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

    Affected: fixed in 7.6.1.

    Fixed in 7.6.1 (released Jul 21, 2026, 86 days before disclosure).

    The latest release, 8.1.2, is not affected.

  • Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

    Affected: fixed in 7.6.1.

    Fixed in 7.6.1 (released Jul 21, 2026, 57 days before disclosure).

    The latest release, 8.1.2, is not affected.

  • CVE-2026-41245Medium 5.9

    Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

    Affected: fixed in 7.5.10.

    Fixed in 7.5.10 (released Apr 15, 2026, 5 days before disclosure).

    The latest release, 8.1.2, is not affected.

  • CVE-2026-28208Medium 5.9

    Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

    Affected: fixed in 7.5.8.

    Fixed in 7.5.8 (released Feb 26, 2026, the day of disclosure).

    The latest release, 8.1.2, is not affected.

  • Infinite loop in junrar

    Affected: fixed in 7.4.1.

    Fixed in 7.4.1 (released Jan 27, 2022, 5 days before disclosure).

    The latest release, 8.1.2, is not affected.

  • Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an…

    Affected: fixed in 1.0.1.

    Fixed in 1.0.1 (released Jun 2, 2018, 12 days before disclosure).

    The latest release, 8.1.2, is not affected.