CVE-2025-6218
RARLAB WinRAR Path Traversal
- Published20 Jun 2025
- Added to CISA KEV9 Dec 2025
- Remediation due30 Dec 2025
Description
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
Affected products
Remediation
References
- https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218
- https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/
- https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6
- https://www.zerodayinitiative.com/advisories/ZDI-25-409/
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2025-6218 being actively exploited?
Yes. CVE-2025-6218 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 9 Dec 2025.
Which products are affected by CVE-2025-6218?
Affected products include Rarlab Winrar.
How do I fix CVE-2025-6218?
Upgrade affected software to a fixed version, for example Rarlab Winrar 7.12 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2025-6218 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.