CVE-2025-52331: XSS
Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52331?
CVE-2025-52331 is classified as a high-severity cross-site scripting vulnerability.
How do I fix CVE-2025-52331?
To fix CVE-2025-52331, upgrade to the latest version of Rarlab WinRAR where the vulnerability has been addressed.
What information can be disclosed due to CVE-2025-52331?
CVE-2025-52331 can disclose sensitive user information such as computer username, generated report directory, and IP address.
Which versions of WinRAR are affected by CVE-2025-52331?
CVE-2025-52331 affects Rarlab WinRAR version 7.11.
What is the cause of CVE-2025-52331?
CVE-2025-52331 is caused by the generate report functionality including archived file names without proper validation.