CVE-2017-12938

7.5 highEPSS 3.0%

UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2017-08-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rarlab:unrar

References

http://seclists.org/oss-sec/2017/q3/290
http://seclists.org/oss-sec/2017/q3/290

Check your stack JSON