Back to CVE Browser

CVE-2022-48579

HIGH

7.5

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-08-07

Last Modified2026-06-17

Data SourcesNVD

Vulnerability Description

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Affected Platforms (CPE)

📦

Rarlab

Unrar

< 6.2.3

References & Advisories

🔗 https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee

🔗 https://lists.debian.org/debian-lts-announce/2023/08/msg00023.html

🔗 https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee

🔗 https://lists.debian.org/debian-lts-announce/2023/08/msg00023.html

Related Vulnerabilities

CVE-2026-141917.8

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvo...

CVE-2023-491028.8

NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file per...

CVE-2022-303337.5

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, ...

CVE-2018-250187.8

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen:...