A path traversal flaw in Junrar’s LocalFolderExtractor bypasses the backslash handling on Linux/Unix, allowing an attacker to drive the library to write any file with arbitrary content to any location on the filesystem when a crafted RAR archive is extracted. The vulnerability is a classic arbitrary file write condition (CWE‑22) that can overwrite critical system files, shell profiles, source code, or cron jobs, leading to remote code execution if the archived payload contains malicious scripts or binaries.

The issue affects all versions of the open‑source Junrar library prior to version 7.5.8. Junrar developers released version 7.5.8 as a fix; any Java application that relies on Junrar for archive extraction on Linux or Unix systems is impacted if it is using an older version of the library.

The vulnerability scores 5.9 on the CVSS scale and carries an EPSS rating of less than 1 %, indicating a moderate severity and a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog, which suggests no known large‑scale exploit activity. The exploitation requires an attacker to supply a malicious RAR archive to a process that performs extraction, a condition that is more likely in environments where users or services routinely handle untrusted archives.