What is the CVSS score of CVE-2026-41245?

CVE-2026-41245 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41245?

Yes, a patch is available for CVE-2026-41245. Update the affected software to the latest version immediately.

Java CVE-2026-41245

EUVD-2026-23872 HIGH

Path Traversal (CWE-22)

2026-04-20 GitHub_M

Path Traversal Java Junrar

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

9.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 03:24 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch released

Apr 23, 2026 - 13:35 nvd

Patch available

Analysis Generated

Apr 20, 2026 - 16:23 vuln.today

Patch available

Apr 20, 2026 - 16:01 EUVD

EUVD ID Assigned

Apr 20, 2026 - 16:00 euvd

EUVD-2026-23872

Analysis Generated

Apr 20, 2026 - 16:00 vuln.today

CVE Published

Apr 20, 2026 - 15:15 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

24 maven packages depend on com.github.junrar:junrar (3 direct, 21 indirect)

Ecosystem-wide dependent count for version 7.5.10.

DescriptionNVD

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.

AnalysisAI

Path traversal in Junrar library versions prior to 7.5.10 allows remote attackers to write arbitrary files into sibling directories by extracting a crafted RAR archive, enabling unauthorized file creation and potential code injection. The vulnerability requires high attack complexity (AC:H) but no authentication or user interaction, affecting any Java application using vulnerable Junrar versions to process untrusted RAR files. Vendor-released patch: version 7.5.10.

Technical ContextAI

Junrar is a Java library for reading and extracting RAR archive format files. The vulnerability exists in the LocalFolderExtractor component, which handles the extraction of archived files to the filesystem. The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), meaning the library fails to properly validate or sanitize file paths extracted from the RAR archive before writing them to disk. An attacker can craft a RAR archive with specially-formed internal path entries (e.g., using directory traversal sequences like '../' or absolute paths) that, when extracted, bypass intended directory restrictions and allow files to be written outside the intended extraction directory into sibling or parent directories. This is a common class of vulnerability in archive extraction libraries where path validation is insufficient.

RemediationAI

Update Junrar to version 7.5.10 or later immediately. For Maven users, update the dependency in pom.xml to <version>7.5.10</version> or higher; for Gradle users, update implementation 'com.github.junrar:junrar:7.5.10' or later. The patch is available directly from GitHub at https://github.com/junrar/junrar/releases/tag/v7.5.10 and the commit resolving the vulnerability is documented at https://github.com/junrar/junrar/commit/d77e9a83eb721cd51f9c23d7869d0e6ad7f952d7. If immediate upgrade is not possible, restrict Junrar usage to extracting RAR files from trusted sources only, and avoid extracting archives in directories where maliciously-created sibling files could impact application functionality (e.g., do not extract to the classpath root or configuration directories). This is a compensating control with significant limitations - it does not prevent exploitation if the source of RAR files cannot be fully guaranteed. Additionally, monitor the extraction directory and parent directories for unexpected file creation, though this detects attacks only after they occur. Patch deployment is the only reliable mitigation.