CVE-2025-6218highunder attackCWE-22

CVE-2025-6218: high-severity vulnerability in RARLAB WinRAR

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor WinRAR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 90%
from disclosure to weapon6 days
Published on NVDJun 21
1st PoC+6d
CISA KEV+171d
Action required by CISAfederal deadline: 2025-12-30

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

WinRAR has a flaw that lets attackers execute harmful code when you open a specially crafted archive file. The vulnerability happens because WinRAR doesn't properly validate file paths inside archives, allowing attackers to place files in unintended locations on your computer.

Technical detail

A directory traversal vulnerability in WinRAR's archive file handling allows remote code execution through a crafted file path that escapes intended directories. The attack requires user interaction to open a malicious archive; upon extraction, the attacker can write executable content to arbitrary locations with the privileges of the current user.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
RARLAB · WinRAR
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — RARLAB WinRAR

In the same product, most dangerous first.

CVE-2022-43650LOWCVE-2022-43650EPSS 23.2%CVE-2023-40477HIGHRARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 11.4%CVE-2025-31334MEDIUMCVE-2025-31334EPSS 1.3%CVE-2024-30370MEDIUMRARLAB WinRAR Mark-Of-The-Web Bypass VulnerabilityEPSS 1.2%CVE-2026-14191HIGHWinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeaderEPSS 0.4%