CVE-2017-12938

High

Published: 18/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.

Risk Assessment

Attackers may gain access to unauthorized files on the system, potentially leading to the exposure of sensitive data or system compromise.

Recommendation

It is recommended to update UnRAR to version 5.5.7 or later to mitigate this vulnerability.

Other vulnerabilities in UnRAR

CVE-2017-14120High
Unrar 0.0.1 (also known as unrar-free or unrar-gpl) has a directory traversal vulnerability in RAR v2 archives, allowing files to be unpacked into the upper directory.

Original NVD description (English source)

UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS