RARLAB UnRAR Directory Traversal Vulnerability (CVE-2022-30333) Technical Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTRARLAB UnRAR utility versions prior to 6.12 on Linux and UNIX platforms.
Attackers can exploit this vulnerability to write arbitrary files outside the extraction directory, potentially leading to Remote Code Execution (RCE).
Immediately upgrade UnRAR to version 6.12 or later, and apply security patches to integrated applications like Zimbra.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the UnRAR package to the latest secure version (6.12 or later) using your system package manager.
# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade unrar -y
# For RedHat/CentOS/Rocky Linux-based systems
sudo dnf upgrade unrar -y
# Verify the installed UnRAR version
unrar | head -n 12. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict the execution of UnRAR or temporarily disable automatic extraction of RAR archives in mail gateways and file upload handlers.
# Restrict execution permissions of the UnRAR binary to privileged users only
sudo chmod 750 /usr/bin/unrar
# Implement sandboxing or AppArmor/SELinux profiles to restrict UnRAR's write access to specific directories only3. Log Audit & IoC Verification Commands
Use the following script to check for vulnerable UnRAR installations and audit recent modifications to sensitive files.
#!/bin/bash
# Check UnRAR installation and version
UNRAR_PATH=$(which unrar)
if [ -z '$UNRAR_PATH' ]; then
echo '[SAFE] UnRAR is not installed on this system.'
else
VERSION=$(unrar 2>&1 | grep -oE 'UNRAR [0-9]+\.[0-9]+')
echo '[INFO] Installed Version: $VERSION'
if [[ '$VERSION' < 'UNRAR 6.12' ]]; then
echo '[WARNING] Vulnerable UnRAR version detected! Immediate upgrade required.'
else
echo '[SAFE] UnRAR version is secure.'
fi
fi
# Audit recent modifications to SSH authorized_keys files
find /home/*/.ssh/authorized_keys -mtime -30 -ls 2>/dev/nullBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-30333) is a directory traversal and symbolic link validation bypass flaw in RARLAB UnRAR for Linux and UNIX systems. While UnRAR attempts to sanitize relative paths to prevent directory traversal, a logical flaw in its path validation routine allows specially crafted symbolic links and directory structures within a RAR archive to bypass these checks. Consequently, during extraction, files can be written to arbitrary locations on the filesystem.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious RAR archive containing directory traversal sequences (e.g., '../../') or symbolic links pointing to sensitive system directories. When an automated service (such as Zimbra Collaboration Suite processing email attachments) or an unsuspecting user extracts this archive, UnRAR bypasses path restrictions and writes files to arbitrary paths. A common exploitation scenario involves writing an SSH public key to '~/.ssh/authorized_keys' or deploying a web shell in a web root directory to achieve Pre-Authentication Remote Code Execution (RCE).
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV catalog, this vulnerability has been actively exploited in the wild by threat actors. For organizations running email gateways or collaboration platforms that automatically parse attachments using UnRAR, this flaw presents an entry point for external attackers to compromise internal networks without authentication. This can lead to full system compromise, data exfiltration, and subsequent lateral movement.
Official Vendor Advisories & References
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Frequently Asked SecOps Questions (CVE-2022-30333)
FAQQ1. How critical is CVE-2022-30333 and is it actively exploited in the wild?
CVE-2022-30333 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 99.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-30333?
Primary impacted vendors include rarlab across unrar. Scope summary: RARLAB UnRAR before version 6.12 on Linux and UNIX platforms (WinRAR and Android RAR are unaffected)
Q3. What temporary mitigations or workarounds exist for CVE-2022-30333 before patching?
[Mitigation] Immediately upgrade UnRAR to version 6.12 or later, and apply security patches to integrated applications like Zimbra. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-30333
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (rarlab)
View Category →Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Microsoft Defender Local Privilege Escalation Vulnerability (CVE-2026-41091) Technical Advisory
[Affected Scope] Windows operating system environments with Microsoft Defender enabled
GNOME Epiphany Browser WebExtension Installation Arbitrary File Overwrite Vulnerability (CVE-2026-118599)
[Affected Scope] GNOME Epiphany browser versions 47.0 and above
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.