CVE-2025-6218

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 90.48%
EPSS Percentile: 99.80%
CISA KEV: YES — Known Exploited Vulnerability

Description

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.

Technical Details

CVSS Version: 3.0
CNA / NVD Source: zdi-disclosures@trendmicro.com
Published: 21-Jun-2025 08:15
Last Modified: 17-Jun-2026 17:01
EPSS Date: 2026-10-11
CWE: CWE-22

CVSS Vector


            CVSS:3.0                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-12-09
Remediation Due: 2025-12-30
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6218

Affected Products / Versions

rarlab / winrar
Version / affected range: * · before (exclusive) 7.12
cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 01:09
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

CVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution Kaspersky Reports Rising Vulnerability Disclosures and Early Exploit Releases in Q2 2026
CVE-2025-6218 Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively Exploited
in this post used CVE-2025-8088, which is related to an earlier directory traversal vulnerability (CVE-2025-6218, patched in WinRAR 7.12) but exploits a different code path through NTFS Alternate Data Streams (ADS). Russia-Aligned Groups Exploit Unpatched WinRAR Flaw in Campaigns Against Ukraine
A peculiarity of the RAR archive is the use of CVE-2025-6218 to place the malware in the startup folder. The malware itself was a patched XPS document loader, xpsrchvw.exe, with Metasploit inside. The malicious Researchers Detail Goffee’s Malware and Stealthy Attacks on Russian Organizations

CVE (81)

Malware (12)

People (6)

Threat Actors (21)

MITRE ATT&CK (27)

Vendors (29)

Products (72)

Tools (19)

Industries (6)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.