Actively exploited · Published Jun 21, 2025 · Assigned by zdi
CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
High 7.8 Exploited
In plain English
A high-severity path traversal in WinRAR from RARLAB. Attackers are actively exploiting it in the wild (listed by CISA on December 9, 2025). The chance it is exploited in the next 30 days is estimated at 90.5% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 30, 2025.
Official description
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- ZDI-25-409 x_research-advisory
- vendor-provided URL vendor-advisory
- https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218 government-resource
- https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/ third-party-advisory