Simon Scannell at SonarSource showed that RarLab’s Unix unrar checks symlink targets for ../ and only afterwards converts Windows backslashes, so ..\..\..\tmp/shell passes the check and writes outside the extraction directory (CVE-2022-30333, fixed in binary 6.12 and source 6.1.7).
In Zimbra, Amavis unpacks RAR attachments of incoming mail for spam and virus scanning, so a single email becomes pre-auth RCE, for example by dropping a JSP shell into the web root on a single-server install.
Validate first, modify afterwards: a classic that never gets old.
CISA added it to its Known Exploited Vulnerabilities catalog on August 9.
Update 2022-08-17: Rapid7 reports active exploitation against Zimbra, notes that the server only has to receive the email, not be internet-facing, and points to Zimbra 9.0.0 Patch 25 and 8.8.15 Patch 32, which replace unrar with 7z.
Update 2022-10-06: The same Amavis path failed again, this time through cpio with .cpio and .tar attachments.