What is the CVSS score of CVE-2026-28208?

CVE-2026-28208 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by CVE-2026-28208?

Organizations using Junrar should be aware of moderate risk from CVE-2026-28208, a path traversal vulnerability rated CVSS 5.9. This could allow unauthorized file access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28208?

Yes, a public proof-of-concept exploit is available for CVE-2026-28208. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-28208?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Java CVE-2026-28208

MEDIUM

Path Traversal (CWE-22)

2026-02-26 security-advisories@github.com

GHSA-j273-m5qq-6825

RCE Java Linux Path Traversal Red Hat Junrar

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 02, 2026 - 21:16 vuln.today

Public exploit code

Patch released

Mar 02, 2026 - 21:16 nvd

Patch available

CVE Published

Feb 26, 2026 - 23:16 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

57 maven packages depend on com.github.junrar:junrar (2 direct, 55 indirect)

Ecosystem-wide dependent count for version 7.5.8.

DescriptionGitHub Advisory

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

AnalysisAI

Junrar versions prior to 7.5.8 contain a path traversal vulnerability in LocalFolderExtractor that allows attackers to write arbitrary files to the filesystem when processing malicious RAR archives on Linux/Unix systems. Public exploit code exists for this vulnerability, which can facilitate remote code execution through file overwrite attacks such as modifying shell profiles or cron jobs. Users should upgrade to version 7.5.8 or later to remediate this issue.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Junrar. Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.