# com.github.junrar:junrar (Maven) vulnerabilities

6 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 8.1.2 (Oct 9, 2026): no advisory affects it
- Newest unaffected release: 8.1.2 (Oct 9, 2026), the latest release
- Dependents: 11
- Releases: 33 since 0.7 (Sep 5, 2012)
- Registry: https://central.sonatype.com/artifact/com.github.junrar/junrar
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-97370: 0.7 to 7.6.0 (7.6.1 is outside it)
- CVE-2026-86071: 0.7 to 7.6.0 (7.6.1 is outside it)
- CVE-2026-41245: 0.7 to 7.5.9 (7.5.10 is outside it)
- CVE-2026-28208: 0.7 to 7.5.7 (7.5.8 is outside it)
- CVE-2022-23596: 0.7 to 7.4.0 (7.4.1 is outside it)
- CVE-2018-12418: 0.7 to 1.0.0 (1.0.1 is outside it)

## Advisories (6)

### [CVE-2026-97370](https://cve.now/CVE-2026-97370): Junrar: RarVM VM\_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

- Severity: High 7.5
- Published: Oct 15, 2026
- Affected: fixed in 7.6.1.
- Fixed in 7.6.1 (released Jul 21, 2026, 86 days before disclosure).
- The latest release, 8.1.2, is not affected.

### [CVE-2026-86071](https://cve.now/CVE-2026-86071): Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

- Severity: Low 3.7
- Published: Sep 16, 2026
- Affected: fixed in 7.6.1.
- Fixed in 7.6.1 (released Jul 21, 2026, 57 days before disclosure).
- The latest release, 8.1.2, is not affected.

### [CVE-2026-41245](https://cve.now/CVE-2026-41245): Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

- Severity: Medium 5.9
- Published: Apr 20, 2026
- Affected: fixed in 7.5.10.
- Fixed in 7.5.10 (released Apr 15, 2026, 5 days before disclosure).
- The latest release, 8.1.2, is not affected.

### [CVE-2026-28208](https://cve.now/CVE-2026-28208): Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

- Severity: Medium 5.9
- Published: Feb 26, 2026
- Affected: fixed in 7.5.8.
- Fixed in 7.5.8 (released Feb 26, 2026, the day of disclosure).
- The latest release, 8.1.2, is not affected.

### [CVE-2022-23596](https://cve.now/CVE-2022-23596): Infinite loop in junrar

- Severity: High 7.5
- Published: Feb 1, 2022
- Affected: fixed in 7.4.1.
- Fixed in 7.4.1 (released Jan 27, 2022, 5 days before disclosure).
- The latest release, 8.1.2, is not affected.

### [CVE-2018-12418](https://cve.now/CVE-2018-12418): Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an…

- Severity: Unrated
- Published: Jun 14, 2018
- Affected: fixed in 1.0.1.
- Fixed in 1.0.1 (released Jun 2, 2018, 12 days before disclosure).
- The latest release, 8.1.2, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.github.junrar:junrar
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.