# CVE-2022-30333

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

- Page: https://www.vulneraibility.com/cve/CVE-2022-30333
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2022-08-09; CISA due date 2022-08-30; known ransomware use
- EPSS: 99.23% (percentile 99.9)
- Public exploit code: 2 Metasploit modules · 5 GitHub proofs of concept (first 2022-07-05)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-08-04)
- Weakness: CWE-59, CWE-22
- Published: 2022-05-09

## Affected

- rarlab:unrar
- debian:debian_linux

## References

- [other] https://www.rarlab.com/rar_add.htm
- [other] https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
- [other] https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
- [other] http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
- [other] https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html
- [advisory] https://security.gentoo.org/glsa/202309-04
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.