The vulnerability is a path traversal flaw, designated CWE-22, located in the LocalFolderExtractor component of the Junrar Java library. An attacker can construct a RAR archive that contains a file whose member name begins with a sibling directory prefix. When the archive is extracted, the library writes the file into the sibling directory, allowing the attacker to create or overwrite arbitrary files with attacker-controlled data. Because the content is fully under the attacker’s control, the flaw can lead to unauthorized file writes, potentially overwriting existing files or placing new files where the application does not expect them.

Affected systems include any Java application that incorporates junrar:junrar prior to version 7.5.10. Versions older than v7.5.10 are vulnerable. The issue is fixed in junrar 7.5.10 and later releases. The product is an open‑source RAR archive handling library used in projects that process compressed files.

The CVSS score of 5.9 classifies the vulnerability as medium severity, and there is no EPSS score indicating current exploitation probability. The flaw is not listed in the CISA KEV catalog. The most likely way to exploit the issue is by supplying a crafted RAR archive to an application that uses the vulnerable library, which is typically a local or vendor‑side operation. The impact is limited to the machine or container where extraction occurs, but can still result in unauthorized file creation or overwrite.