CVE-2025-6218

7.8

HIGH CVSS 3.0

WinRAR Directory Traversal Remote Code Execution Vulnerability

Description

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.

INFO

Published Date :

June 21, 2025, 1:15 a.m.

Last Modified :

June 25, 2025, 7:03 p.m.

Remotely Exploit :

No

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-6218 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Microsoft	windows
1	Rarlab	winrar

: Total Affected Vendor : 2 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.0	HIGH				[email protected]

Solution

This information is provided by the 3rd party feeds.

Upgrade to RARLAB WinRAR version 7.12 Beta 1 or later.

Public PoC/Exploit Available at Github

CVE-2025-6218 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-6218.

URL	Resource
https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6	Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-25-409/	Third Party Advisory VDB Entry

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-6218 is associated with the following CWEs:

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-6218 weaknesses.

CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-126: Path Traversal Path Traversal

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

carolus21rex/Carolus--CVE-Collection

This repository serves as a central index (“link tree”) to my research into known vulnerabilities (CVEs). The goal is to strengthen technical understanding of how these flaws arise, how they are safely reproduced in controlled environments, and what mitigations can be applied to defend against them.

Updated: 5 days, 12 hours ago

0 stars 0 fork 0 watcher

Born at : Aug. 18, 2025, 3:16 p.m. This repo has been linked 1 different CVEs too.

absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE

CVE-2025-6218 is a directory traversal vulnerability in WinRAR that allows an attacker to place files outside the intended extraction directory when a user extracts a specially crafted

Updated: 1 month ago

3 stars 0 fork 0 watcher

Born at : July 10, 2025, 1:37 a.m. This repo has been linked 1 different CVEs too.

mulwareX/CVE-2025-6218-POC

RARLAB WinRAR Directory Traversal Remote Code Execution

Python

Updated: 1 month ago

6 stars 2 fork 2 watcher

Born at : July 3, 2025, 4:52 a.m. This repo has been linked 1 different CVEs too.

skimask1690/CVE-2025-6218-POC

Proof of Concept for CVE-2025-6218, demonstrating the exploitation of a vulnerability in WinRAR versions 7.11 and under, involving improper handling of archive extraction paths.

Batchfile

Updated: 1 month ago

7 stars 4 fork 4 watcher

Born at : July 1, 2025, 5:34 a.m. This repo has been linked 1 different CVEs too.

ignis-sec/CVE-2025-6218

A simple proof of concept for WinRAR Path Traversal | RCE | CVE-2025-6218

Python

Updated: 1 month ago

9 stars 4 fork 4 watcher

Born at : June 29, 2025, 7:06 p.m. This repo has been linked 1 different CVEs too.

speinador/CVE-2025-6218_WinRAR

None

Batchfile

Updated: 1 month, 2 weeks ago

13 stars 4 fork 4 watcher

Born at : June 27, 2025, 12:11 a.m. This repo has been linked 1 different CVEs too.

plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.

delivr-to/detections

A home for detection content developed by the delivr.to team

YARA

Updated: 1 week, 6 days ago

69 stars 6 fork 6 watcher

Born at : Feb. 8, 2023, 5:38 p.m. This repo has been linked 5 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 5 hours, 54 minutes ago

7209 stars 1199 fork 1199 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 806 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-6218 vulnerability anywhere in the article.

Daily CyberSecurity

Beyond the Inbox: How a Cyber-Espionage Group Is Exploiting Two WinRAR Vulnerabilities

BI.ZONE Threat Intelligence uncovered a series of targeted cyber-espionage campaigns conducted by the Paper Werewolf (GOFFEE) cluster, which weaponized both a known WinRAR vulnerability (CVE-2025-6218 ...

Published Date: Aug 21, 2025 (3 days, 3 hours ago)

CybersecurityNews

Paper Werewolf Exploiting WinRAR Zero‑Day Vulnerability to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated campaign by the Paper Werewolf threat actor group, also known as GOFFEE, targeting Russian organizations through the exploitation of critical v ...

Published Date: Aug 20, 2025 (3 days, 19 hours ago)

Ars Technica

High-severity WinRAR 0-day exploited for weeks by 2 groups

A high-severity zero-day in the widely used WinRAR file compressor is under active exploitation by two Russian cybercrime groups. The attacks backdoor computers that open malicious archives attached t ...

Published Date: Aug 12, 2025 (1 week, 5 days ago)

The Register

Russia's RomCom among those exploiting a WinRAR 0-day in highly-targeted attacks

Russia-linked attackers found and exploited a high-severity WinRAR vulnerability before the maintainers of the Windows file archiver issued a fix. The bug, tracked as CVE-2025-8088, is a path-traversa ...