Vulnerability record · CVE-2022-30333 · published 9 May 2022
CVE-2022-30333: UnRAR path traversal allows arbitrary file write on Linux and UNIX
Rarlab · Unrar
RARLAB UnRAR before 6.12 on Linux and UNIX fails to properly sanitize paths during extraction, allowing directory traversal writes outside the intended destination. An attacker can craft a RAR archive that writes files such as ~/.ssh/authorized_keys, leading to unauthorized access. WinRAR and Android RAR are unaffected.
Description
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Automated analysis
critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and enables pre-auth remote code execution in common deployments like Zimbra.
What it is
RARLAB UnRAR before 6.12 on Linux and UNIX fails to properly sanitize paths during extraction, allowing directory traversal writes outside the intended destination. An attacker can craft a RAR archive that writes files such as ~/.ssh/authorized_keys, leading to unauthorized access. WinRAR and Android RAR are unaffected.
Impact
An attacker can write arbitrary files to locations writable by the extracting user, enabling SSH key injection and potential remote code execution or privilege escalation depending on the context.
Attack surface
Reached by supplying a malicious RAR archive to a service or user that extracts it with vulnerable UnRAR; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
CISA KEV lists it as known exploited with ransomware campaign use, and EPSS is 0.99085 (99.931st percentile); references include exploit write-ups for Zimbra pre-auth RCE via UnRAR.
What to do
- Upgrade UnRAR to 6.12 or later on all Linux and UNIX systems.
- Apply vendor updates for Debian and Gentoo packages that bundle UnRAR.
- Restrict or sandbox archive extraction services so they run with minimal filesystem permissions.
- Avoid extracting untrusted RAR archives on systems where UnRAR cannot be patched immediately.
Detection
- Monitor for creation or modification of ~/.ssh/authorized_keys and other sensitive files by archive extraction processes.
- Alert on UnRAR processes writing outside expected extraction directories.
- Review logs for RAR archives containing traversal sequences (../) or absolute paths.
- Hunt for unexpected SSH key additions on hosts that process RAR uploads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-30333 to the Known Exploited Vulnerabilities catalog on 9 August 2022 as "RARLAB UnRAR Directory Traversal Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 30 August 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-30333 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-30333), CISA KEV, FIRST EPSS (scores of 2026-09-17). This page is refreshed as NVD updates the record.
