CVE-2022-30333 is a directory traversal vulnerability in RARLAB UnRAR. CISA added it to the Known Exploited Vulnerabilities catalogue on 9 August 2022, which means attackers have used it in real attacks. RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
What this vulnerability means in practice
CVE-2022-30333 matters because directory traversal turns an archive extractor into a file-writing primitive. In RARLAB UnRAR on Linux and UNIX, a crafted archive can push output outside the intended extraction directory, which makes the unpack step dangerous rather than routine.
That kind of flaw is especially serious in software that processes untrusted archives, email attachments, build artifacts, or uploaded files. Attackers often look for extraction paths because they can be used to place files where administrators do not expect them, including locations that affect startup, configuration, or later code execution.
For the authoritative vulnerability record, use the CVE Program entry and the NIST National Vulnerability Database alongside the vendor advisory for exact scope and remediation details.
Why directory traversal during extraction is dangerous
Directory traversal in an archive handler is not just a file path bug, it is a trust boundary failure. The application assumes the archive’s internal names are safe, then writes files based on attacker-controlled paths. That can overwrite existing files, plant new ones, or alter files that will later be executed or loaded.
The danger increases when extraction happens with elevated privileges, inside automation, or in a shared directory tree. In those environments, a single malicious archive can affect more than one user or workflow and can become a stepping stone to persistence or broader system compromise.
For a broader view of how path traversal fits into real-world attack patterns, see Web Application Attacks Guide, which places directory traversal alongside related file-writing and input-handling weaknesses.
How organisations assess exposure
Exposure assessment starts with asset inventory: identify every system that includes RARLAB UnRAR, bundles it in a larger product, or uses it as part of an automated unpacking flow. The next question is whether those systems ever process untrusted archives from users, partners, mail gateways, CI pipelines, or third-party feeds.
Internet exposure is only one part of the picture. Even internal-only systems can be at risk if archive processing is reachable through a service, shared job runner, or upload pipeline. Vendor advisories and CISA KEV status are the fastest way to confirm whether a given deployment falls inside the vulnerable product line and whether active exploitation is already known.
For prioritisation and verification workflow, the Vulnerability Management Guide is useful for mapping asset scope, KEV review, and remediation tracking to a working process.
Remediation, detection, and post-exploitation review
Remediation should follow the vendor’s fix guidance first, with CISA KEV used to confirm urgency. If patching must wait, reduce exposure by limiting who can supply archives, isolating extraction jobs, and constraining the directories where unpacking is allowed to write.
Detection should focus on what changed after extraction, not just on the archive itself. Review unexpected file creation, overwritten configuration, new startup entries, and changes under directories that the application normally should not touch. If exploitation is suspected, treat any planted file as a possible persistence mechanism and check whether the archive processing account can modify other sensitive paths.
When exploitation is possible, credential and access review may also be needed, especially if the vulnerable process runs with service credentials or can influence application secrets. That is where attack-path analysis becomes important: the issue is not only whether the archive was malicious, but what the write access could reach afterward.
See the Vulnerability Management Guide for remediation discipline and the CVE Program for authoritative vulnerability identification, then use vendor guidance to validate the exact fixed release.
Risk and Threat Considerations
Directory traversal in an unpacker is dangerous because it gives an attacker control over where extracted content lands. In a real compromise, that can mean overwriting trusted files, planting payloads, or altering application behavior without needing direct shell access first.
Failure mechanism: The extractor fails to normalise or constrain archive paths before writing, so attacker-supplied names escape the intended destination and land in sensitive locations.
Impact: File overwrite, persistence, configuration tampering, and in some environments a path toward code execution or broader system compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Directory traversal flaws are exposed through asset and vulnerability management. |
| Recommendation — Track archive-handling software in inventory and remediate exposed systems through continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The issue arises from failing to validate archive-controlled paths before writing files. |
| SI-2 — Flaw Remediation | Known exploited vulnerabilities require timely remediation and verification. | |
| Recommendation — Validate archive paths before extraction to prevent writes outside the intended directory. Apply flaw remediation processes to vulnerable archive-handling software and verify fixes against KEV status. | ||
| OWASP ASVS | V5 — File Handling | Archive extraction and path handling are core file-processing security concerns. |
| Recommendation — Enforce secure file-handling checks so extracted content cannot escape the intended destination. | ||
Practitioner Guidance
Why practitioners should care: Archive extraction is often treated as a low-risk utility function, but any component that writes attacker-influenced paths should be reviewed as a security control point. This is especially important in services that process uploads or automate unpacking in privileged environments.
What to watch for: Any workflow that extracts archives into shared, privileged, or long-lived directories deserves extra scrutiny, because the blast radius is driven by where the files can be written, not by the file type alone.
Practitioner takeaway: Treat untrusted archive extraction as an input-validation and write-boundary problem, not just a file-handling task.
Related resources from NHI Mgmt Group
- What are the signs that CVE-2022-26923 exploitation is underway in Active Directory?
- CVE-2015-0666 (Cisco Prime Data Center Network Manager (DCNM) Directory Traversal)
- CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation)
- CVE-2026-34926 (Trend Micro Apex One (On-Premise) Directory Traversal)