{"id":"CVE-2022-30333","published":"2022-05-09T08:15:06Z","modified":"2026-10-02T14:54:55Z","title":"RARLAB UnRAR Directory Traversal Vulnerability","vendor":"RARLAB","product":"UnRAR","tier":"core","eol":null,"description":{"text":"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.","provenance":"source","from":"NVD"},"summary":{"text":"RARLAB UnRAR versions before 6.12 on Linux and UNIX contain a directory traversal flaw in the extract (unpack) routine, which does not restrict where extracted files are written. The issue does not affect WinRAR or Android RAR. An attacker who can supply a crafted archive that the victim extracts with UnRAR can write files outside the intended extraction directory, for example creating ~/.ssh/authorized_keys, and no prior authentication or privileges are needed for the archive delivery itself.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:19Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99233,"percentile":0.99936,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-08-09","dueDate":"2022-08-30","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"Vulnerability updated with version 6.12. Accessing link will download update information: https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz;  https://nvd.nist.gov/vuln/detail/CVE-2022-30333","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-09","exploitedFirstSeen":"2022-08-09","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-09"},{"url":"https://assets.sentinelone.com/wt-reports/watchtower_2022_eoy","date":"2023-01-18"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-228a","date":"2023-01-27"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-278a","date":"2023-10-05"},{"url":"https://cyberint.com/blog/research/ransomware-trends-q3-2023-report/","date":"2023-10-21"},{"url":"https://cyberint.com/blog/research/ransomware-trends-and-statistics-2023-report/","date":"2024-04-24"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202309-04","tags":["Third Party Advisory"]},{"url":"https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz","tags":["Patch"]},{"url":"https://www.rarlab.com/rar_add.htm","tags":["Product"]},{"url":"http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202309-04","tags":["Third Party Advisory"]},{"url":"https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz","tags":["Patch"]},{"url":"https://www.rarlab.com/rar_add.htm","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: victim user extracts a malicious archive","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows directory traversal to write to files during an extract (aka unpack) operation","start":43,"end":128}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary file write alters stored data","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows directory traversal to write to files during an extract","start":43,"end":105}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-52276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52276","exploited":true,"exploitedSince":"2022-08-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":2,"earliest":"2022-07-05","earliestUrl":"https://github.com/TheL1ghtVn/CVE-2022-30333-PoC","repos":[{"name":"rbowes-r7/unrar-cve-2022-30333-poc","url":"https://github.com/rbowes-r7/unrar-cve-2022-30333-poc","stars":14,"created":"2022-07-15"},{"name":"TheL1ghtVn/CVE-2022-30333-PoC","url":"https://github.com/TheL1ghtVn/CVE-2022-30333-PoC","stars":13,"created":"2022-07-05"},{"name":"aslitsecurity/Zimbra-CVE-2022-30333","url":"https://github.com/aslitsecurity/Zimbra-CVE-2022-30333","stars":7,"created":"2022-07-26"}]},"metasploit":[{"name":"UnRAR Path Traversal (CVE-2022-30333)","module":"exploit/linux/fileformat/unrar_cve_2022_30333","type":"exploit","disclosureDate":"2022-06-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb"},{"name":"UnRAR Path Traversal in Zimbra (CVE-2022-30333)","module":"exploit/linux/http/zimbra_unrar_cve_2022_30333","type":"exploit","disclosureDate":"2022-06-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb"}],"first":{"date":"2022-06-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html","https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/"],"flow":[{"stage":"primary","techniques":["T1565.001"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2022-05-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30333","provenance":"source"},{"date":"2022-06-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-07-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb","provenance":"source"},{"date":"2022-08-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-08-09","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52276","provenance":"source"}],"speed":{"daysToPublicExploit":50,"firstExploitFrom":"Metasploit","daysToKev":92},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1542 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 3 PoC-in-GitHub repos; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}