Detections
Analytics

Echo: com.github.junrar:junrar: security update to 7.6.1

low Tenable Self-Hosted Container Security Plugin ID 463845

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in
 src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended
 extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only
 the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments
 with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination
 while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-
 directory squatting that can make later security-sensitive writes fail. The demonstrated impact is
 directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.
 (CVE-2026-86071)

Solution

Update the com.github.junrar:junrar library and its related packages to version 7.6.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-86071

Plugin Details

Severity: Low

ID: 463845

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-86071

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-86071