CVE-2022-30333: RARLAB UnRAR Directory Traversal Vulnerability

CVE-2022-30333 is a directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX systems. It allows an attacker to write files outside the intended extraction path during an unpack operation. Because UnRAR is commonly used in automated pipelines, mail gateways, and forensic or backup workflows, successful abuse can overwrite critical files or drop malicious content. CISA notes known ransomware use of this issue, so timely remediation matters for any environment that processes untrusted RAR archives.

How it works

The flaw belongs to the directory-traversal and link-following classes (CWE-22 and CWE-59). When UnRAR extracts an archive, it fails to adequately sanitize or constrain path components and symbolic links supplied inside the archive. An attacker who can supply a crafted RAR file can therefore cause the extractor to write (or overwrite) files at locations chosen by the attacker rather than remaining inside the target directory. On Linux and UNIX hosts this can affect system configuration, service binaries, or user data, depending on the privileges under which UnRAR runs. Exact exploit mechanics and preconditions must be confirmed against the vendor advisory; defenders should treat any untrusted archive processed by a vulnerable UnRAR binary as a potential write primitive.

Am I affected? How to find it in your systems

UnRAR appears on Linux and UNIX systems wherever RAR archives are handled—mail attachment scanners, CI/CD artifact unpackers, backup restore tools, security appliances, and developer workstations. Inventory steps include:

• Searching package managers and file systems for the unrar binary or libraries linked against RARLAB UnRAR.
• Checking container images, virtual-machine templates, and appliance firmware that may bundle UnRAR.
• Reviewing scripts, cron jobs, and services that invoke unrar or equivalent extraction utilities on incoming files.
• Confirming the installed version and build against the vendor advisory; public detail on exact affected releases is limited here, so treat any unpatched UnRAR on Linux/UNIX as in scope until verified.

Telemetry signs of exploitation are limited to unexpected file writes outside extraction directories, creation of suspicious symlinks, or process activity that unpacks RARs from untrusted sources. Correlate file-integrity monitoring alerts, audit logs of write operations by the unrar process, and any subsequent anomalous process launches.

How to remediate

Patch first. Apply the updates supplied by RARLAB according to the vendor instructions, as required by CISA. After updating:

• Replace or rebuild any containers, appliances, or golden images that still contain the vulnerable binary.
• Re-scan systems to confirm the old UnRAR is no longer present.
• Where extraction is performed by third-party products, obtain and apply their corresponding security updates that incorporate the fixed UnRAR.
• Harden remaining extraction workflows: run UnRAR under a least-privilege account, confine it with chroot, containers, or seccomp, and extract only into dedicated, non-executable temporary directories that are cleaned after use.

If you can't patch immediately

Reduce exposure until the vendor update can be deployed:

• Segment hosts that must process RAR files; deny them unnecessary network and filesystem access.
• Disable or bypass UnRAR-based extraction for untrusted input; prefer alternative tools that have been verified free of this issue, or quarantine archives for manual review.
• Apply virtual patching where feasible—WAF or mail-gateway rules that block or detonate suspicious RAR attachments before they reach the extractor.
• Enforce strict filesystem permissions and immutable flags on sensitive paths so that even a successful traversal write fails.
• Increase monitoring: alert on unrar process execution, unexpected writes outside designated extract directories, and subsequent privilege-escalation or ransomware behaviors.

If your data may have been exposed

Actively exploited vulnerabilities, including those with documented ransomware use, frequently lead to broader compromise and data theft. If you have evidence that crafted archives were processed by a vulnerable UnRAR instance, treat the host as potentially breached: isolate it, preserve forensic images, and begin incident-response procedures. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.