PT-2022-7118 · Unrar+5 · Unrar+5

Published 2022-12-20 · Updated 2026-02-06 · CVE-2022-48579

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions UnRAR versions prior to 6.2.3

Description The issue is related to the incorrect handling of symbolic links before accessing a file, which can be exploited by a remote attacker to gain access to confidential data. This can occur via symlink chains, allowing the extraction of files outside of the destination folder.

Recommendations For versions prior to 6.2.3, update to version 6.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2025-5948

AZL-27870

AZL-34592

BDU:2023-07638

CLEANSTART-2026-LA13761

CLEANSTART-2026-NJ87139

CLEANSTART-2026-TC95380

CLEANSTART-2026-WX01708

CVE-2022-48579

DLA-3535-1

USN-7350-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Ubuntu

Unrar

References · 105

• https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-11423 · Security Note
• https://osv.dev/vulnerability/AZL-27870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12376 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0361 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0202 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20698 · Security Note
• https://osv.dev/vulnerability/AZL-34592 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48579 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48579 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NJ87139 · Vendor Advisory