CVE-2022-30333

UnRAR versions before 6.12 on Linux and UNIX have a flaw that lets attackers write files outside the intended folder when extracting RAR archives, potentially creating or modifying sensitive files like SSH keys. This could allow unauthorized access to a system.

A path traversal vulnerability (CWE-22, CWE-59) in UnRAR <6.12 on Linux/UNIX allows arbitrary file write during extraction when processing specially crafted RAR archives. An attacker can exploit this by providing a malicious archive that writes to locations outside the extraction directory (e.g., ~/.ssh/authorized_keys), bypassing directory constraints and enabling privilege escalation or unauthorized access.