PT-2025-26225 · Winrar · Winrar

Marcin Bobryk · Published 2025-06-19 · Updated 2026-06-23 · CVE-2025-6218

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RARLAB WinRAR versions prior to 7.12

Description A directory traversal flaw exists in the handling of file paths within archive files. This issue allows remote attackers to execute arbitrary code in the context of the current user if a target opens a specially crafted malicious file or visits a malicious page. The flaw enables the extraction process to traverse to unintended directories, including sensitive system folders such as Startup, which can lead to the automatic execution of malicious code. This issue has been actively exploited in the wild by threat groups including APT-C-08 (Manlinghua), GOFFEE, and Bitter, and has been used in campaigns to deploy QuasarRAT malware.

Recommendations Update to version 7.12 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-07480

CVE-2025-6218

ZDI-25-409

Affected Products

Winrar

References · 208

• 🔥 https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit · Exploit
• 🔥 https://secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move · Exploit
• https://win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6218 · Security Note
• https://bdu.fstec.ru/vul/2025-07480 · Security Note
• https://win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6218 · Vendor Advisory
• https://twitter.com/wvipersg/status/1998725609212522909 · Twitter Post
• https://t.me/aptreports/24706 · Telegram Post
• https://twitter.com/smica83/status/2012574082991005773 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/1998725963379888546 · Twitter Post
• https://twitter.com/blackorbird/status/1986747686050287997 · Twitter Post
• https://twitter.com/smica83/status/2001989976406503532 · Twitter Post
• https://twitter.com/smica83/status/2043959088778789044 · Twitter Post