RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demons…

published 2022-05-09 4 y ago modified 2026-10-02 37 d ago also EUVD-2022-52276

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-08-09, used in ransomware
epss: 99.2%; EPSS 99.2% chance of exploitation in 30 days, percentile 99.9%
public exploits: 2; Metasploit

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1 distros 3 links 1

rarlab unrar 6.12

debian ubuntu suse

rar Debian 14, Debian 13, Debian 12 2:6.20~b1-0.1
unrar-nonfree Debian 14, Debian 13, Debian 12 1:6.1.7-1

debian advisories DEBIAN-CVE-2022-30333

rar Ubuntu 20.04 LTS 2:6.23-1~20.04.1
rar Ubuntu 22.04 LTS 2:6.23-1~22.04.1
rar Ubuntu 24.04 LTS 2:6.23-1
libclamunrar Ubuntu 20.04 LTS 0.103.11-0ubuntu0.20.04.1
libclamunrar Ubuntu 22.04 LTS 0.103.11-0ubuntu0.22.04.1
unrar-nonfree Ubuntu 20.04 LTS 1:5.6.6-2ubuntu0.1
unrar-nonfree Ubuntu 22.04 LTS 1:6.1.5-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2022-30333

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

unrar SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 5.6.1-4.8.1

suse advisories SUSE-SU-2022:1760-1

rarlab.com/rar/rarlinux-x32-612.tar.gz patch

Timeline

2022-05-09 Published
2022-06-28 First public exploit (Metasploit exploit/linux/fileformat/unrar_cve_2022_30333)
2022-08-09 Added to CISA KEV
2022-08-30 CISA patch deadline
2026-08-04 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-08-09)
Patch by: 2022-08-30 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: RARLAB, UnRAR
CISA name: RARLAB UnRAR Directory Traversal Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 3 mo ago (2026-08-04)

Exploit prediction

99.23% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/fileformat/unrar_cve_2022_30333 UnRAR Path Traversal (CVE-2022-30333) metasploit exploit, excellent rank, 2022-06-28
Metasploit exploit/linux/http/zimbra_unrar_cve_2022_30333 UnRAR Path Traversal in Zimbra (CVE-2022-30333) metasploit exploit, excellent rank, 2022-06-28
blog.sonarsource.com https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-59 Improper Link Resolution Before File Access
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

rarlab.com /rar/rarlinux-x32-612.tar.gz
patch
blog.sonarsource.com /zimbra-pre-auth-rce-via-unrar-0day/
exploit, third-party-advisory
packetstormsecurity.com /files/167989/Zimbra-UnRAR-Path-Traversal.html
exploit, third-party-advisory, vdb-entry
security.gentoo.org /glsa/202309-04
vendor-advisory, third-party-advisory
rarlab.com /rar_add.htm
product
lists.debian.org /debian-lts-announce/2023/08/msg00022.html
mailing-list, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333
government-resource, us-government-resource

Sources

CVE List CVE-2022-30333
NVD CVE-2022-30333

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary