CVE-2025-6218: RARLAB WinRAR Path Traversal Vulnerability
RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
Other sources
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow vendor-provided mitigations for the RARLAB WinRAR Directory Traversal Remote Code Execution vulnerability (ZDI-CAN-27198) and/or discontinue use of the product if mitigations are unavailable, especially where users must open malicious files or visit malicious pages.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6218?
CVE-2025-6218 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-6218?
To fix CVE-2025-6218, you should update RARLAB WinRAR to the latest version provided by the vendor.
Which versions of RARLAB WinRAR are affected by CVE-2025-6218?
CVE-2025-6218 affects certain versions of RARLAB WinRAR prior to the vendor's security update.
Do I need user interaction to exploit CVE-2025-6218?
Yes, user interaction is required to exploit CVE-2025-6218, as the target must visit a malicious link.
What could attackers achieve by exploiting CVE-2025-6218?
Exploiting CVE-2025-6218 allows attackers to execute arbitrary code on compromised systems.