ANT-2026-9VJ9JJXQ: Arbitrary file write due to backslash path traversal

Arbitrary file write due to backslash path traversal.

Target

Project: junrar
Discovery: static analysis — not yet dynamically reproduced

Technical Details

Path sanitization fails to account for backslash (\) as a directory separator, allowing traversal sequences to bypass checks and write files to arbitrary locations.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-9VJ9JJXQ.

---

Reference: ANT-2026-9VJ9JJXQ
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

{
  "ant_id": "ANT-2026-9VJ9JJXQ",
  "bug_class": "Path Traversal",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:45:57+00:00",
  "description": "Arbitrary file write due to backslash path traversal.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "junrar",
  "reproduction": null,
  "technical_details": "Path sanitization fails to account for backslash (`\\`) as a directory separator, allowing traversal sequences to bypass checks and write files to arbitrary locations.",
  "title": "Arbitrary file write due to backslash path traversal",
  "vendor_severity": null
}