CVE-2025-6218
RARLAB WinRAR Path Traversal Vulnerability
Description
CVE-2025-6218 is a high-severity directory traversal vulnerability in RARLAB WinRAR that enables remote code execution. With a CVSS v3.0 base score of 7.8, this flaw allows a remote attacker to execute arbitrary code on affected installations by exploiting improper handling of file paths within archive files. User interaction is required, as the victim must open a malicious archive file or visit a page that triggers archive processing. The vulnerability affects WinRAR versions prior to 7.12 and has been exploited by the APT-C-08 threat group. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 30, 2025, and carries an EPSS score of 0.05469 (90.0th percentile), indicating a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rarlab | winrar | < 7.12 |
References
- https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6(Release Notes)
- https://www.zerodayinitiative.com/advisories/ZDI-25-409/(Third Party Advisory, VDB Entry)
- https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218(US Government Resource)
- https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/(Exploit, Third Party Advisory)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-6218 is classified under CWE-22, which describes a condition where an application fails to properly neutralize special elements in a pathname, allowing an attacker to access files or directories outside the intended restricted directory. In the case of WinRAR, the vulnerability exists in how the software handles file paths stored within archive files. An attacker can craft an archive containing entries with path traversal sequences (such as ../) that, when extracted, cause files to be written to locations outside the intended extraction directory. This is particularly dangerous because it can be used to place malicious executables in startup folders, overwrite system files, or deposit payloads in locations where they will be automatically executed. Learn more about CWE-22
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). Successful exploitation allows the attacker to write arbitrary files to arbitrary locations on the victim's filesystem and achieve code execution. This grants the attacker the ability to read sensitive data, install persistent malware, modify system configurations, and disrupt system operations.
Business Impact is significant given WinRAR's estimated user base of over 500 million installations worldwide. The software is widely used in enterprise environments for handling compressed files, and archive files are one of the most common file types exchanged through email, file sharing services, and download portals. An attacker can distribute a malicious archive that appears legitimate, and a single user opening it can lead to full system compromise.
Exploitation Context is concerning. The vulnerability has been attributed to exploitation by APT-C-08, a known advanced persistent threat group, as documented by Foresiet and SecPod. The EPSS score of 0.05469 (90.0th percentile) indicates that exploitation probability is higher than 90% of all known vulnerabilities, reflecting both targeted APT campaigns and broader opportunistic exploitation. The ransomware association is listed as "Unknown" by CISA, but archive-based code execution vulnerabilities are historically favored by ransomware operators for initial access through phishing campaigns.
Exploit Maturity
CVE-2025-6218 has confirmed active exploitation by advanced threat actors. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 30, 2025. The vulnerability has been attributed to the APT-C-08 threat group, with detailed analysis published by Foresiet and SecPod documenting the exploitation techniques and campaign tactics.
The EPSS score of 0.05469 (90.0th percentile) places this vulnerability in the top 10% of most likely exploited CVEs. The Zero Day Initiative has published an advisory (ZDI-25-409) documenting the vulnerability details, and RARLAB has issued a patch notification with the release of WinRAR 7.12. The attack requires user interaction (opening a malicious archive), which limits fully automated exploitation but is readily achievable through social engineering, phishing emails with archive attachments, and compromised download sites. The ransomware association is listed as "Unknown," but WinRAR vulnerabilities have historically been adopted by ransomware groups as part of their initial access toolkits.
Remediation
-
Update WinRAR to Version 7.12 or Later — Download and install the latest version of WinRAR from the official RARLAB website. Version 7.12 addresses the directory traversal vulnerability by properly validating and sanitizing file paths within archive entries during extraction. Ensure all installations across the organization are updated, including portable or standalone deployments.
-
Block Malicious Archive Files at the Email Gateway — Configure email security solutions to scan archive attachments for path traversal indicators and known exploitation patterns. Consider blocking archive formats commonly used for exploitation (such as RAR and ZIP files with deeply nested or unusual path structures) or requiring them to pass through sandboxed detonation before delivery.
-
Implement Application Whitelisting — Deploy application control policies that prevent execution of files written to unexpected locations, such as temporary directories, user profile folders, and startup locations. This provides defense-in-depth against the code execution that follows successful directory traversal exploitation.
-
Educate Users About Archive-Based Threats — Train employees to exercise caution when opening archive files from untrusted or unexpected sources. Emphasize that archive files received via email, messaging platforms, or download links can contain malicious content even when they appear to be from legitimate senders.
-
Monitor Endpoint Activity — Deploy endpoint detection and response (EDR) solutions that monitor for files being written to sensitive directories during archive extraction operations. Alert on WinRAR processes that create files outside the designated extraction directory, which is a strong indicator of exploitation attempts.
Technical Details
CVE-2025-6218 is a directory traversal vulnerability in RARLAB WinRAR that exists in the handling of file paths within archive files. The flaw allows an attacker to craft an archive containing entries with manipulated paths that cause extracted files to be placed outside the intended extraction directory, leading to arbitrary code execution.
CVSS Vector Breakdown: The CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector reflects a local attack requiring user interaction. Attack Vector (AV:L) indicates the attacker must have local access or deliver a file locally (the malicious archive must be opened by the victim). Attack Complexity (AC:L) means no special conditions are needed beyond the victim opening the file. Privileges Required (PR:N) confirms no special privileges are needed. User Interaction (UI:R) means the victim must open the malicious archive or visit a page triggering archive processing. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The attacker constructs a specially crafted archive file (RAR, ZIP, or other supported format) containing one or more entries with manipulated file paths. These paths include directory traversal sequences that navigate out of the extraction directory and into attacker-chosen locations on the filesystem. When the victim opens or extracts the archive using WinRAR, the software follows the embedded paths without proper validation, writing the attacker's payload files to arbitrary locations. Common targets for file placement include Windows Startup folders (to achieve persistence through automatic execution at login), user profile directories, and application data folders where the files will be loaded by other software. The vulnerability was identified through analysis by the Zero Day Initiative and has been observed in the wild being used by the APT-C-08 threat group, which delivered crafted archives through targeted phishing campaigns.
Frequently Asked Questions
Who is exploiting CVE-2025-6218?
The vulnerability has been attributed to the APT-C-08 advanced persistent threat group, which has been observed using crafted WinRAR archives in targeted phishing campaigns. However, given the public availability of vulnerability details and the widespread use of WinRAR, broader exploitation by other threat actors is expected.
How does the directory traversal lead to code execution?
The attacker includes files in the archive with paths containing traversal sequences (e.g., ../) that cause them to be extracted outside the intended directory. By placing executable files in Windows Startup folders, application data directories, or other locations where they will be automatically loaded, the attacker achieves code execution without the victim explicitly running the malicious file.
Which WinRAR versions are affected?
All WinRAR versions prior to 7.12 are affected. Users should update to version 7.12 or later, which properly validates file paths during extraction to prevent directory traversal attacks.
Is this vulnerability related to previous WinRAR path traversal issues?
WinRAR has had previous path traversal vulnerabilities, most notably CVE-2023-38831, which was also widely exploited. CVE-2025-6218 represents a separate vulnerability in the file path handling code that was not addressed by previous patches, underscoring the importance of maintaining WinRAR at the latest version.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.