CVE-2025-6218: WinRAR path traversal in archive file handling leads to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-certain EPSS score and public exploit references, and successful exploitation yields code execution as the user.

What it is

WinRAR mishandles file paths inside archive files, allowing a crafted path to traverse out of the intended extraction directory (CWE-22). Because the traversal can place attacker-controlled files in locations the process later executes, it escalates from a path bug to remote code execution in the context of the current user. It matters because WinRAR is widely deployed and exploitation requires only that a user open a malicious archive or visit a malicious page.

Impact

An attacker gains arbitrary code execution with the privileges of the user running WinRAR. That typically means full access to the user's files, credentials and any resources that user can reach.

Attack surface

Reached locally through the archive handling path: the CVSS vector is AV:L/PR:N/UI:R, so no authentication is needed but user interaction is required, consistent with the description that the target must open a malicious file or visit a malicious page.

Exploitation

CISA added it to KEV on 2025-12-09 with a 2025-12-30 remediation due date, and EPSS gives a 30-day probability of 0.90538 (99.795th percentile). Two references are tagged Exploit, indicating public exploit material exists; no ransomware campaign use is recorded.

What to do

• Update WinRAR to the vendor-fixed release referenced in the RARLAB release notes, then verify the installed version across all endpoints.
• If patching cannot be completed before the KEV due date, restrict or block opening untrusted archives and consider discontinuing WinRAR on exposed systems per CISA guidance.
• Enforce least privilege so users do not run WinRAR with administrative rights, limiting the impact of code execution.
• Block archive attachments and downloads from untrusted sources at mail and web gateways where operationally feasible.

Detection

• Monitor for WinRAR processes writing files outside expected extraction directories, especially into startup folders, user profile paths or system directories.
• Alert on WinRAR spawning child processes such as script interpreters or command shells, which is abnormal for normal extraction.
• Hunt for archive files containing path traversal sequences in entry names, and for archives delivered from external or newly registered domains.
• Review endpoint telemetry for file creation events where the parent process is WinRAR and the target path differs from the user-selected extraction folder.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.