PT-2025-26225 · Winrar · Winrar

Marcin Bobryk · Published 2025-06-19 · Updated 2025-10-06 · CVE-2025-6218

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WinRAR versions 7.11 and earlier

Description WinRAR contains a directory traversal vulnerability that allows remote attackers to execute arbitrary code on affected systems. User interaction is required, such as opening a malicious file or visiting a malicious page. The vulnerability stems from improper handling of file paths within archive files, enabling crafted file paths to traverse to unintended directories. Exploitation can lead to code execution in the context of the current user. Approximately 500 million users worldwide are potentially affected. The vulnerability, tracked as CVE-2025-6218, was discovered by whs3-detonator and reported through the Zero Day Initiative. The Paper Werewolf threat group has been observed exploiting this vulnerability in targeted attacks against organizations in Russia. The vulnerability allows attackers to manipulate archive paths, potentially writing to protected system folders.

Recommendations Update to WinRAR version 7.12 beta 1 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-07480

CVE-2025-6218

ZDI-25-409

Affected Products

Winrar

References · 72

• 🔥 https://github.com/speinador/CVE-2025-6218_WinRAR · Exploit
• https://win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-409 · Security Note
• https://bdu.fstec.ru/vul/2025-07480 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6218 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/722058 · Security Note
• https://t.me/defcon_news/130737 · Telegram Post
• https://reddit.com/r/Action1/comments/1luvbmr/%F0%9D%90%93%F0%9D%90%A8%F0%9D%90%9D%F0%9D%90%9A%F0%9D%90%B2%F0%9D%90%AC_%F0%9D%90%8F%F0%9D%90%9A%F0%9D%90%AD%F0%9D%90%9C%F0%9D%90%A1_%F0%9D%90%93%F0%9D%90%AE%F0%9D%90%9E%F0%9D%90%AC%F0%9D%90%9D%F0%9D%90%9A%F0%9D%90%B2_%F0%9D%90%A8%F0%9D%90%AF%F0%9D%90%9E%F0%9D%90%AB%F0%9D%90%AF%F0%9D%90%A2%F0%9D%90%9E%F0%9D%90%B0 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1mp0aea/top_10_trending_cves_13082025 · Reddit Post
• https://twitter.com/Tudorel92659164/status/1960380968499282219 · Twitter Post
• https://twitter.com/leonov_av/status/1962907250911047703 · Twitter Post
• https://twitter.com/bizone_en/status/1958072803862679671 · Twitter Post
• https://twitter.com/Cyber_O51NT/status/1958073743256744424 · Twitter Post
• https://twitter.com/nextronresearch/status/1955038619959279952 · Twitter Post
• https://t.me/true_secator/7315 · Telegram Post