CVE-2025-6218
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
- Record
CVE-2025-6218- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2025-28706
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
- Record
EUVD-2025-28706- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8x66-x5gf-2pc8
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows...
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
- Record
GHSA-8x66-x5gf-2pc8- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CISA KEV No score
RARLAB WinRAR Path Traversal Vulnerability
RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
- Record
CVE-2025-6218- Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
- Record
CVE-2025-6218- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | speinador/CVE-2025-6218_WinRAR | 2025-06-27 |
| PoC in GitHub | ignis-sec/CVE-2025-6218 | 2025-06-29 |
| PoC in GitHub | skimask1690/CVE-2025-6218-POC | 2025-07-01 |
| PoC in GitHub | mulwareX/CVE-2025-6218-POC | 2025-07-03 |
| PoC in GitHub | absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE | 2025-07-10 |
| PoC in GitHub | Chrxstxqn/CVE-2025-6218-WinRAR-RCE-POC | 2025-12-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-6218 is a high vulnerability (CVSS 7.8) in Rarlab Winrar, published June 21, 2025. CISA lists it as known to be exploited, since December 9, 2025. EUVD reports exploitation since December 9, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.5%, the 99th percentile. No source names a fixed version.
References
zerodayinitiative.com/advisories/ZDI-25-409
win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6
secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218
foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit
nvd.nist.gov/vuln/detail/CVE-2025-6218
github.com/advisories/GHSA-8x66-x5gf-2pc8