junrar EUVD-2026-81011

Exploitation requires the host application to extract an attacker-supplied RAR archive using junrar's LocalFolderExtractor (the vulnerable extraction path) in a version prior to 7.6.1. The malicious archive entry must be crafted so its final canonical path resolves inside the destination (passing createFile()'s check) while intermediate directory segments escape the root via unchecked mkdir() - this specificity is why AC:H applies. Limiting factors: impact is confined to directory creation and path squatting (no arbitrary file-content write, no confidentiality loss); the application must both use this specific extractor and process untrusted archives; and the Windows regression test is disabled, indicating the escape behaves per POSIX path semantics.

This is a genuinely low-priority issue and the vendor's CVSS of 3.7 is honest, not inflated. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N correctly captures a narrow flaw: the demonstrated impact is unauthorized directory creation outside the extraction root (filesystem pollution / file-vs-directory squatting), with C:N, A:N and only I:L. The description is explicit that this is NOT arbitrary file-content write - createFile() still validates the final canonical path, so the classic zip-slip write primitive is blocked; only makeFile()'s unchecked intermediate mkdir() calls escape. AC:H is appropriate because the crafted entry must simultaneously make the final path resolve inside the destination while intermediate segments escape it. No EPSS score, no CISA KEV listing, and no public exploit were provided; a proof-of-concept RAR test fixture (mkdir-escape.rar) ships in the fix commit as a regression test but that is a maintainer test asset, not a weaponized public exploit. No signals conflict here - every source points to low real-world risk. The only real-world amplifier is exploitability being data-only (a crafted archive), so it can be triggered wherever untrusted RAR archives are auto-extracted via LocalFolderExtractor.

An application uses junrar's LocalFolderExtractor to unpack user-supplied RAR archives (e.g. an upload/ingest pipeline). An attacker submits a crafted archive whose entry name causes intermediate mkdir() calls to create directories outside the intended extraction root, polluting the filesystem or squatting a path so a later security-sensitive write fails. No public weaponized exploit is identified, though a regression-test RAR fixture exists in the fix commit.