CVE-2022-30333

libclamunrar9: RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack...

CVE-2022-30333 is fixed in 7 products on 1 platform, first by DEBIAN-CVE-2022-30333, released May 9, 2022. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on August 9, 2022, with known ransomware use. Patch Radar priority: Patch now.

Patch nowCISA KEVKnown ransomware use

CVSS

7.5

High

Exploitation

Exploited

Listed by CISA

CISA KEV

Aug 9, 2022

Federal due date Aug 30, 2022. Known ransomware use

EPSS

0.9923

99th percentile

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
libclamunrar · Ubuntu 22.04.1 LTS (jammy)	0.103.11-0ubuntu0.22.04.1	libclamunrar 0.103.11-0ubuntu0.22.04.1	Aug 24, 2023
libclamunrar9 · Ubuntu 20.04 LTS (focal)	0.103.11-0ubuntu0.20.04.1	libclamunrar9 0.103.11-0ubuntu0.20.04.1	Aug 24, 2023
libclamunrar9 · Ubuntu 22.04.1 LTS (jammy)	0.103.11-0ubuntu0.22.04.1	libclamunrar9 0.103.11-0ubuntu0.22.04.1	Aug 24, 2023
libunrar-headers · Ubuntu 22.04.1 LTS (jammy)	1:6.1.5-1ubuntu0.1	libunrar-headers 1:6.1.5-1ubuntu0.1	Apr 28, 2024
libunrar5 · Ubuntu 20.04 LTS (focal)	1:5.6.6-2ubuntu0.1	libunrar5 1:5.6.6-2ubuntu0.1	Apr 28, 2024
libunrar5 · Ubuntu 22.04.1 LTS (jammy)	1:6.1.5-1ubuntu0.1	libunrar5 1:6.1.5-1ubuntu0.1	Apr 28, 2024
rar · Debian 12.15 (bookworm)	2:6.20~b1-0.1	DEBIAN-CVE-2022-30333	May 9, 2022
rar · Debian 13.5 (trixie)	2:6.20~b1-0.1	DEBIAN-CVE-2022-30333	May 9, 2022
rar · Debian 14	2:6.20~b1-0.1	DEBIAN-CVE-2022-30333	May 9, 2022
rar · Ubuntu 20.04 LTS (focal)	2:6.23-1~20.04.1	rar 2:6.23-1~20.04.1	Aug 24, 2023
rar · Ubuntu 22.04.1 LTS (jammy)	2:6.23-1~22.04.1	rar 2:6.23-1~22.04.1	Aug 24, 2023
rar · Ubuntu 24.04.5 LTS (noble)	2:6.23-1	rar 2:6.23-1	Aug 24, 2023
rar · Ubuntu 24.10 (oracular)	2:6.23-1	rar 2:6.23-1	Aug 25, 2023
rar · Ubuntu 25.04 (plucky)	2:6.23-1	rar 2:6.23-1	Aug 25, 2023
unrar · Ubuntu 20.04 LTS (focal)	1:5.6.6-2ubuntu0.1	unrar 1:5.6.6-2ubuntu0.1	Apr 28, 2024
unrar · Ubuntu 22.04.1 LTS (jammy)	1:6.1.5-1ubuntu0.1	unrar 1:6.1.5-1ubuntu0.1	Apr 28, 2024
unrar-nonfree · Debian 12.15 (bookworm)	1:6.1.7-1	DEBIAN-CVE-2022-30333	May 9, 2022
unrar-nonfree · Debian 13.5 (trixie)	1:6.1.7-1	DEBIAN-CVE-2022-30333	May 9, 2022
unrar-nonfree · Debian 14	1:6.1.7-1	DEBIAN-CVE-2022-30333	May 9, 2022

Details

Published
May 9, 2022
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA required action
Apply updates per vendor instructions.

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/cve/CVE-2022-30333">CVE-2022-30333 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is this on your machines?

Patchblox finds every install below the fixed version on Windows, macOS and Linux, and updates them through your release rings.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.