CVE-2004-1027: Arjsoftware Unarj

Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.

Affected products

• Arjsoftware Unarj: version 2.62 only; version 2.63 only; version 2.64 only; version 2.65 only
• Debian Debian Linux: version 3.0 only
• Gentoo Linux: any version

Published 2005-03-01. Last modified 2026-06-16.