CVE-2026-86071

Low

Advisory

Published 17 Sept 2026In the index since 18 Sept 2026

Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Carried by container images the latest versions of 3 of 18,090 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
junrarmaven	3.0.1-Ubooquity, 4.0.0	7.6.1	2

3 by stars

Chart

Latest

Affected images

Radar Score

airsonicgeek-cookbook

1 of the 1 container images this version deploys carry CVE-2026-86071.

Container image	Digest	Package	Fixed in
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.6.1

18,930

1 of the 1 container images this version deploys carry CVE-2026-86071.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1

4,343

1 of the 1 container images this version deploys carry CVE-2026-86071.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1

4,343

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1	2
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.6.1	1