{"action":"Upgrade com.github.junrar:junrar to 7.6.1 or later.","affected":[{"fixed":"7.6.1","introduced":"0"}],"component":"com.github.junrar:junrar","cve_ids":["CVE-2026-86071"],"ecosystem":"Maven","epss":0.00362,"exploited":false,"fixed_versions":["7.6.1"],"ghsa_id":"GHSA-89m4-43j5-vhhx","id":"tcs_01M5N8MCTBTQP5JCDTN2FK0PJ5","modified_at":"2026-09-17T16:45:06.345577098Z","published_at":"2026-09-17T16:30:46Z","references":["https://osv.dev/vulnerability/GHSA-89m4-43j5-vhhx","https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx","https://nvd.nist.gov/vuln/detail/CVE-2026-86071","https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343","https://github.com/junrar/junrar","https://github.com/junrar/junrar/releases/tag/v7.6.1"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-89m4-43j5-vhhx","url":"https://osv.dev/vulnerability/GHSA-89m4-43j5-vhhx"}],"summary":"Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root"}