---
id: "CVE-2025-6218"
kind: "vulnerability"
aliases: ["CVE-2025-6218"]
title: "RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "rarlab winrar", "fixed": ["7.12"], "affected": "< 7.12", "ecosystem": "vendor"}, {"name": "RARLAB WinRAR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "windows", "winrar"]
not_affected_if: ["no-winrar-installed"]
published_at: "2025-06-21T01:15:29+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6218", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6218", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability

WinRAR, the Windows archive tool, has a path traversal flaw that lets a crafted archive write files outside the folder it is extracted to. An attacker can use this to run code as the user who opens the archive.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:rarlab winrar affected < 7.12 fixed 7.12
- vendor:RARLAB WinRAR affected ? fixed ?

## How to check

Open WinRAR, go to Help, About WinRAR and note the version number.

## Fix

Update WinRAR to the latest release from rarlab.com; the sources do not name the fixed version.
If no fix is available, stop using WinRAR for untrusted archives, per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6218
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-6218

## From the sources

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_