Is CVE-2022-30333 (RARLAB UnRAR Directory Traversal) being exploited in the wild?

What the KEV listing means for exposure and response

For this CVE, the practical answer is not just that exploitation exists, but that the vulnerability has crossed the threshold where defenders should assume real-world abuse. CISA’s KEV listing is a signal to validate whether any UnRAR deployment remains reachable in your environment, then treat that exposure as an active risk until inventory, remediation, and post-change verification are complete.

When the flaw is present, the concern is not limited to extraction-time failure. A directory traversal during unpacking can let an attacker write files outside the intended destination, which changes the problem from a simple archive-handling bug to a potential path toward planting malicious files, altering startup locations, or overwriting sensitive content.

What to verify before you treat systems as safe

Start by confirming whether Linux and UNIX systems still include the vulnerable UnRAR component anywhere archives are processed, including servers, automation jobs, build systems, and endpoints that unpack untrusted files. The most common miss is assuming the tool is only on a user workstation when it also exists inside scripts, image build pipelines, or file-processing services.

Then verify how archives are handled in practice. If extraction runs with elevated permissions, if write locations are predictable, or if the extracted content is later consumed automatically, the blast radius increases materially. For a vulnerability of this type, “we only unpack trusted files” is not a sufficient control statement unless that trust boundary is actually enforced and monitored.

If you need the authoritative vulnerability record and current remediation context, cross-check the CVE Program entry and the CISA Known Exploited Vulnerabilities Catalog, then use the vendor advisory for version-specific guidance rather than trying to infer it from the exploit narrative.

Why traversal in an unpacker is operationally serious

Directory traversal in archive extraction matters because the archive is often treated as data, while the extraction path becomes a write primitive. That means a single unpack operation can cross a trust boundary and create files where defenders do not expect them, including locations that influence execution, configuration, or later processing.

In real environments, this kind of bug is especially dangerous when file handling is automated. Services that ingest customer uploads, email attachments, software packages, backup archives, or build artifacts can turn one malicious archive into a broader compromise path if the extracted payload reaches a privileged or persistent location.

For broader context on how active exploitation changes prioritisation, the Zero-Day and Exploited Vulnerabilities Guide is useful because it ties KEV, emergency mitigation, and post-patch hunting together in the same workflow. For teams managing many findings, the Vulnerability Management Guide helps translate that signal into asset scoping, prioritisation, and verification.

Risk and Threat Considerations

Because exploitation is known and ransomware use is documented, the threat is not theoretical. The main risk is that archive handling becomes an entry point for file placement in locations that affect execution, persistence, or later-stage compromise, especially when extraction is performed by privileged automation or on systems with broad write access.

Failure mechanism: A crafted archive can traverse out of the intended extraction directory and write attacker-chosen files to a different location, which can enable tampering, payload staging, or overwrite of files that matter to the host or application.

Impact: Successful abuse can lead to malware placement, follow-on execution, service disruption, or a foothold that supports broader compromise, particularly where archive processing is trusted and unattended.

Practitioner Guidance

What to prioritise: Treat every system that extracts RAR archives as in scope until you have confirmed the component is absent, replaced, or remediated. Prioritise internet-facing file intake, automation pipelines, and hosts where archive extraction is privileged or frequent.

What to verify: Confirm that archived content is extracted only into restricted paths, that the process cannot write outside its sandbox, and that file ownership and permissions do not let a dropped file become executable or authoritative. If you cannot prove that containment, do not assume the extraction workflow is safe.

Practitioner takeaway: For an actively exploited archive parser flaw, the decisive question is not whether the exploit is elegant, but whether any business process still trusts extracted files enough to let a traversal write become a real foothold.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2022-30333 (RARLAB UnRAR Directory Traversal)?
• CVE-2022-30333 (RARLAB UnRAR Directory Traversal)
• Is CVE-2015-0666 (Cisco Prime Data Center Network Manager (DCNM) Directory Traversal) being exploited in the wild?
• Is CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?