CVE-2022-30333

The vulnerability in RARLAB's UnRAR tool prior to version 6.12 on Linux and UNIX systems is characterized by a directory traversal flaw that allows an attacker to manipulate file paths during the extraction process. This weakness arises from improper validation of file paths, enabling malicious actors to craft specially designed RAR archives that, when extracted, can lead to the overwriting or creation of files in arbitrary locations. A particularly concerning scenario involves the ability to create or modify the `~/.ssh/authorized_keys` file, which would grant unauthorized access to the affected system via SSH. This flaw highlights the critical need for secure handling of file paths in software that processes compressed archives.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could distribute a malicious RAR file, perhaps disguised as a legitimate document or software package, to unsuspecting users. Once the target extracts the archive using the vulnerable version of UnRAR, the attacker could execute commands or scripts that leverage the unauthorized access granted by the modified `authorized_keys` file. This exploitation could be performed remotely, making it particularly dangerous in environments where users frequently download and extract files from untrusted sources. Additionally, the simplicity of the attack—requiring only the extraction of a crafted archive—lowers the barrier to entry for potential attackers.

The real-world impact of this vulnerability is significant, especially for organizations that rely on Linux and UNIX systems for their operations. The ability to gain unauthorized access to a system can lead to data breaches, loss of sensitive information, and potential disruption of services. For businesses, the financial implications can be severe, encompassing costs related to incident response, system recovery, and reputational damage. Furthermore, regulatory repercussions may arise if sensitive data is compromised, leading to fines and legal liabilities. The risk is exacerbated in environments where users have elevated privileges, as attackers could leverage this access to escalate their control over the system and network.

To detect and mitigate this vulnerability, organizations should prioritize updating to the latest version of UnRAR, specifically version 6.12 or later, which addresses this flaw. Regular software updates and patch management practices are essential to maintaining a secure environment. Additionally, employing file integrity monitoring solutions can help detect unauthorized changes to critical files, such as `~/.ssh/authorized_keys`. Organizations should also educate users about the risks associated with extracting files from untrusted sources and implement strict policies regarding the handling of compressed files. Employing least privilege principles can further reduce the potential impact of exploitation, ensuring that users have only the necessary permissions to perform their tasks.

In conclusion, the directory traversal vulnerability in RARLAB's UnRAR tool poses a significant threat to Linux and UNIX systems, with the potential for unauthorized access and severe business risks. Understanding the technical details, potential attack vectors, and real-world implications is crucial for organizations to effectively defend against this and similar vulnerabilities. By implementing robust detection and mitigation strategies, businesses can safeguard their systems and data from exploitation, thereby enhancing their overall cybersecurity posture.

CSURFACE threat intelligence has identified a marked escalation in exploitation activity targeting CVE-2022-30333, driven by the emergence of multiple publicly available proof-of-concept exploits and the introduction of a Metasploit module. This development significantly lowers the technical barrier for threat actors, enabling a broader range of adversaries to weaponize the directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX systems. Our telemetry indicates a sharp increase in exploitation attempts, coinciding with the vulnerability’s addition to the CISA KEV catalog and a substantial rise in its EPSS score, now approaching critical levels. The availability of diverse exploit code repositories further accelerates the risk of widespread compromise, particularly as ransomware groups have been observed leveraging this flaw in targeted campaigns. These factors collectively elevate the threat level from moderate to high, underscoring an urgent need for defenders to prioritize detection and response efforts around this vulnerability.

Update 2 — July 19, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2022-30333, with detection activity doubling over recent monitoring periods. This surge coincides with the wider dissemination of multiple new proof-of-concept exploits across public repositories, increasing the accessibility of attack tools for a broader range of threat actors. Notably, ransomware groups continue to incorporate this vulnerability into their operational playbooks, leveraging the directory traversal flaw to establish persistent footholds and facilitate lateral movement within compromised environments. Although the EPSS score remains stable, the rapid proliferation of exploit code and the observed uptick in exploitation attempts collectively elevate the operational risk associated with this vulnerability. Consequently, the threat level should be reassessed as heightened, reflecting an increased likelihood of successful attacks and potential impact on affected Linux and UNIX systems.

Update 3 — August 03, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2022-30333, accompanied by a slight upward revision in the EPSS score. This increase in observed activity correlates with the recent emergence of multiple new proof-of-concept exploits publicly available on code repositories, which have lowered the technical barrier for threat actors to weaponize the directory traversal vulnerability in UnRAR on Linux and UNIX systems. The proliferation of these exploits, including those tailored for integration with popular enterprise software like Zimbra, suggests expanding attacker interest and potential for more widespread abuse. Although the vulnerability remains unexploited in Windows and Android environments, the intensifying Linux/UNIX exploitation landscape elevates the operational risk, particularly for organizations with exposed or legacy UnRAR deployments. Consequently, the threat level associated with CVE-2022-30333 should be reassessed as heightened, reflecting an increased likelihood of successful exploitation and persistent foothold establishment by ransomware groups and other advanced adversaries.