CyberSec.Space Logo
Back to CVE Browser

CVE-2022-30333

🔥 Known Exploited (CISA KEV)HIGH
7.5
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2022-05-09
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Affected Platforms (CPE)

📦
Rarlab

Unrar

< 6.12
💻
Debian

Debian Linux

= 10.0

References & Advisories

🔗 http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
🔗 https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
🔗 https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html
🔗 https://security.gentoo.org/glsa/202309-04
🔗 https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
🔗 https://www.rarlab.com/rar_add.htm
🔗 http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
🔗 https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/

Related Vulnerabilities

CVE-2026-141917.8

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvo...

CVE-2023-491028.8

NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file per...

CVE-2022-485797.5

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

CVE-2018-250187.8

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen:...