THREAT OPS › Threat News › [GHSA] GHSA-89m4-43j5-vhhx (low) — Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
[GHSA] GHSA-89m4-43j5-vhhx (low) — Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
GHSA-89m4-43j5-vhhx Severity: low CVE: CVE-2026-86071
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
## Summary
`LocalFolderExtractor` validates only the final canonical file path before extraction. However, `makeFile()` creates intermediate directories one path segment at a time without checking whether each created directory remains inside the dest
Indicators of compromise
- CVE-2026-86071cve
Original source: https://github.com/advisories/GHSA-89m4-43j5-vhhx