CVE-2026-28208

Medium

Advisory

Published 27 Feb 2026In the index since 8 Sept 2026

Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
junrarmaven	3.0.1-Ubooquity, 4.0.0	7.5.8	2

3 by stars

Chart

Latest

Affected images

Radar Score

airsonicgeek-cookbook

1 of the 1 container images this version deploys carry CVE-2026-28208.

Container image	Digest	Package	Fixed in
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.5.8

18,230

1 of the 1 container images this version deploys carry CVE-2026-28208.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.5.8

4,303

1 of the 1 container images this version deploys carry CVE-2026-28208.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.5.8

4,303

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.5.8	2
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.5.8	1