{"action":"Upgrade com.github.junrar:junrar to 7.5.8 or later.","affected":[{"fixed":"7.5.8","introduced":"0"}],"component":"com.github.junrar:junrar","cve_ids":["CVE-2026-28208"],"ecosystem":"Maven","epss":0.14739,"exploited":false,"fixed_versions":["7.5.8"],"ghsa_id":"GHSA-j273-m5qq-6825","id":"tcs_01M5N91RWDJWS4WYM7JTGKFDQS","modified_at":"2026-02-28T06:41:21.602161Z","published_at":"2026-02-27T22:09:27Z","references":["https://osv.dev/vulnerability/GHSA-j273-m5qq-6825","https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825","https://nvd.nist.gov/vuln/detail/CVE-2026-28208","https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954","https://github.com/junrar/junrar","https://github.com/junrar/junrar/releases/tag/v7.5.8"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-j273-m5qq-6825","url":"https://osv.dev/vulnerability/GHSA-j273-m5qq-6825"}],"summary":"Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix"}