RARLAB · UnRAR
CVE-2022-30333
RARLAB UnRAR Directory Traversal Vulnerability
Exploited in attacks
Used by ransomware
Critical 9.8 Attack chance: 99.2%
What it is
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CISA: RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: August 30, 2022
- Added to the CISA list
- August 9, 2022
- Published
- May 9, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.2% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22 CWE-59
- More details
- NVD · CVE.org · CISA
All references (6)
- https://security.gentoo.org/glsa/202309-04
- https://www.rarlab.com/rar_add.htm
- https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
- https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
- http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html
More exploited flaws from RARLAB
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 9, 2025 | Path Traversal | WinRAR | High 7.8 | 90% |
| Aug 12, 2025 | Path Traversal | WinRAR | High 8.4 | 95% |
| Aug 24, 2023 | Code Execution | WinRAR | High 7.8 | 99.8% |
| Feb 15, 2022 | Absolute Path Traversal | WinRAR | High 7.8 | 96% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.