{"id":"CVE-2025-6218","published":"2025-06-21T01:15:29Z","modified":"2026-06-17T10:01:24Z","title":"RARLAB WinRAR Path Traversal Vulnerability","vendor":"RARLAB","product":"WinRAR","tier":"core","eol":null,"description":{"text":"RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in how RARLAB WinRAR handles file paths inside archive files lets a crafted entry write or resolve outside the intended directory. An attacker needs only local access with no privileges, but the target user must open a malicious archive or visit a malicious page for code to run in that user's context.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:30Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90479,"percentile":0.998,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-12-09","dueDate":"2025-12-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6218","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-08","exploitedFirstSeen":"2025-08-08","ransomware":false,"evidence":[{"url":"https://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/","date":"2025-08-08"},{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","date":"2025-08-12"},{"url":"https://ptsecurity.com/ru-ru/research/analytics/russia-cyberthreat-landscape-2026/#id11","date":"2025-10-08"},{"url":"https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247507464&idx=1&sn=fa744e1c4a49e29091fc417d2ca74226&chksm=","date":"2025-11-07"},{"url":"https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/","date":"2025-11-12"},{"url":"https://blog.synapticsystems.de/how-a-russian-threat-actor-uses-recent-winrar-vulnerability-in-their-ukraine-operations/","date":"2025-12-01"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","date":"2025-12-01"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-november-2025-2dbb7721adf8","date":"2025-12-03"},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/","date":"2025-12-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-12-09"}],"evidenceTotal":23,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6","tags":["Release Notes"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-409/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218","tags":["US Government Resource"]},{"url":"https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/","tags":["Exploit","Third Party Advisory"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens malicious archive file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the target must visit a malicious page or open a malicious file","start":251,"end":314}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-28706","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28706","exploited":true,"exploitedSince":"2025-12-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2025-06-27","earliestUrl":"https://github.com/speinador/CVE-2025-6218_WinRAR","repos":[{"name":"skimask1690/CVE-2025-6218-POC","url":"https://github.com/skimask1690/CVE-2025-6218-POC","stars":30,"created":"2025-07-01"},{"name":"absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE","url":"https://github.com/absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE","stars":19,"created":"2025-07-10"},{"name":"speinador/CVE-2025-6218_WinRAR","url":"https://github.com/speinador/CVE-2025-6218_WinRAR","stars":16,"created":"2025-06-27"},{"name":"ignis-sec/CVE-2025-6218","url":"https://github.com/ignis-sec/CVE-2025-6218","stars":12,"created":"2025-06-29"},{"name":"mulwareX/CVE-2025-6218-POC","url":"https://github.com/mulwareX/CVE-2025-6218-POC","stars":10,"created":"2025-07-03"}]},"first":{"date":"2025-06-27","source":"PoC-in-GitHub","url":"https://github.com/speinador/CVE-2025-6218_WinRAR"},"provenance":"source"},"exploitRefs":["https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/","https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"ai"}],"timeline":[{"date":"2025-06-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6218","provenance":"source"},{"date":"2025-06-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/speinador/CVE-2025-6218_WinRAR","provenance":"source"},{"date":"2025-08-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/","provenance":"source"},{"date":"2025-12-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-12-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28706","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":171},"priority":{"score":68.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 449 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}