high7.5
CVE-2022-48579
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
Impact
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rarlab | Unrar | before 6.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee
- https://lists.debian.org/debian-lts-announce/2023/08/msg00023.html
- https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee
- https://lists.debian.org/debian-lts-announce/2023/08/msg00023.html