CVE-2025-6218

What it actually does

The flaw is a path traversal vulnerability in WinRAR archive extraction path handling. A malicious archive can contain crafted file names or paths that escape the intended extraction directory and cause files to be written to attacker-chosen locations accessible to the current user. By placing an executable, script, shortcut, or autostart artifact in a location such as the user's Startup folder, the attacker can achieve code execution in the context of the user who opens or extracts the archive. The vulnerability requires user interaction, such as opening a malicious archive or visiting a page that delivers one, but exploitation is reported as active in the wild and the EPSS score indicates a high likelihood of exploitation.

Why it matters to the business

Successful exploitation can let an attacker run malware under the victim user's account, leading to credential theft, ransomware staging, persistence, data theft, or lateral movement from workstations where WinRAR is installed. Because archive files are commonly exchanged through email, chat, file-sharing sites, and software download workflows, the operational exposure can be broad even when the vulnerable application is not internet-facing. The vulnerability is in CISA KEV with a remediation due date of 2025-12-30, exploitation is active in the wild, and the high EPSS score makes rapid remediation important for organizations using WinRAR broadly.

How an attack unfolds

An attacker crafts a RAR or other WinRAR-supported archive containing file entries with traversal paths designed to escape the user-selected extraction directory. The attacker delivers the archive through phishing, a compromised website, malvertising, social media, file-sharing platforms, or a drive-by download flow. When the victim opens or extracts the archive with a vulnerable WinRAR installation, WinRAR processes the malicious path and writes one or more files outside the intended destination. A common abuse pattern is dropping a script, executable, or shortcut into a per-user Startup folder so the payload runs at the next logon, or placing content in another user-writable location that is later executed by the user. Code then executes with the victim's privileges, enabling the attacker to establish persistence, download second-stage malware, steal browser/session credentials, or move laterally using the user's access. Public reporting associated with 2025 vulnerability and exploit landscape tracking indicates active exploitation of this WinRAR path traversal issue, so defenders should treat suspicious archive handling and unexpected autostart artifacts as high-priority investigation leads.

How to fix it

Upgrade WinRAR to a vendor-fixed version as soon as available from RARLAB or approved software distribution channels. Because no exact fixed version was provided in the input, security teams should verify the currently installed WinRAR version against the latest RARLAB advisory for CVE-2025-6218 and standardize on the newest supported release. Remove or block unsupported WinRAR versions where upgrades are not possible. As interim mitigations, restrict execution of WinRAR from untrusted download locations, block or quarantine suspicious archives from email and web gateways, disable automatic opening of downloaded archives, and use application control to prevent execution from user-writable directories such as Downloads, Temp, and Startup folders. Ensure endpoint protection scans archives and extracted contents, and consider replacing vulnerable archive handlers in high-risk workflows until patching is complete.

How to confirm the fix worked

Confirm exposure by inventorying endpoints for WinRAR installations and checking executable versions for WinRAR.exe, Rar.exe, and UnRAR.exe against the vendor-fixed release. Validate that software deployment successfully updated or removed vulnerable installations across workstations, terminal servers, and build or packaging systems. Test mitigations by confirming that endpoint controls block execution from user-writable paths and that email/web security controls quarantine archives with traversal-style entries. To validate the fix safely, use vendor-provided tests or a benign archive designed to verify that traversal entries cannot write outside the chosen extraction directory; do not use live exploit samples in production. Confirm no unexpected files were created in user Startup folders, Temp directories, Downloads folders, or other autostart locations during the period before remediation.

Typical attack path

1. Attacker creates a malicious archive with crafted traversal paths that cause extracted files to be written outside the intended extraction directory.
2. Attacker delivers the archive through phishing email, messaging platforms, malicious downloads, compromised websites, or social engineering.
3. Victim opens or extracts the archive using a vulnerable WinRAR installation.
4. WinRAR writes an attacker-controlled payload, script, shortcut, or configuration file to an unintended user-writable location.
5. The payload is executed immediately through user interaction or later through an autostart mechanism such as the user's Startup folder.
6. Attacker gains code execution as the current user and establishes persistence or downloads additional tooling.
7. Attacker performs credential theft, reconnaissance, data collection, lateral movement, or malware/ransomware staging depending on objectives.

How to detect it

Review endpoint, EDR, email gateway, web proxy, and file creation telemetry for evidence that malicious archives were opened and wrote files outside the expected extraction path. Key log sources include process creation events, file creation events, archive scanning logs, browser download history, email attachment telemetry, Windows Security logs, Sysmon, PowerShell logs, scheduled task logs, Run key changes, and endpoint protection alerts. Hunt for WinRAR.exe, Rar.exe, or UnRAR.exe creating files in Startup folders, Temp paths, Downloads paths, ProgramData startup locations, or other autostart locations. Look for child processes spawned directly or shortly after WinRAR activity, especially command shells, script hosts, LOLBins, or newly dropped executables. Examine recently received or downloaded archives for traversal sequences such as ../ or ..\, absolute Windows paths, or entries targeting Startup folders. In forensic review, correlate archive download/open time with creation of .exe, .dll, .bat, .cmd, .ps1, .vbs, .js, .hta, .lnk, or .url files in user-writable locations. Also inspect persistence mechanisms including Startup folders, Run/RunOnce registry keys, scheduled tasks, WMI event consumers, and newly installed services. Because exploitation is active in the wild, treat suspicious WinRAR extraction plus unexpected autostart file creation as a likely compromise path and proceed with endpoint containment and malware triage.

• WinRAR.exe
• Rar.exe
• UnRAR.exe
• ..\\
• ../
• %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
• C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
• C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.exe
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.bat
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.cmd
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.vbs
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.js
• \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.ps1
• ParentImage=*\\WinRAR.exe Image=*\\cmd.exe
• ParentImage=*\\WinRAR.exe Image=*\\powershell.exe
• ParentImage=*\\WinRAR.exe Image=*\\wscript.exe
• ParentImage=*\\WinRAR.exe Image=*\\cscript.exe
• ParentImage=*\\WinRAR.exe Image=*\\mshta.exe
• ParentImage=*\\WinRAR.exe Image=*\\rundll32.exe
• ParentImage=*\\WinRAR.exe Image=*\\regsvr32.exe
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
• HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce

What your security team should do

• Immediately identify all systems with WinRAR installed, prioritizing user workstations, shared desktops, VDI images, terminal servers, and systems used by high-risk users who frequently handle external archives.
• Upgrade WinRAR to the latest vendor-fixed version or remove it where not required; track completion against the CISA KEV due date of 2025-12-30.
• Hunt for suspicious archive extraction activity followed by creation of executables, scripts, shortcuts, or documents in Startup folders and other autostart locations.
• Add email and web gateway detections for archives containing traversal sequences, absolute paths, or suspicious autostart-targeted file paths.
• Use EDR or application control to block execution of newly written files from Downloads, Temp, archive extraction folders, and Startup directories unless explicitly trusted.
• Investigate any recent WinRAR-spawned child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or unknown executables.
• Increase monitoring for credential theft, persistence creation, and second-stage payload downloads on endpoints where vulnerable WinRAR versions were used before patching.
• Educate users not to open unexpected archives and route suspicious archive attachments to security teams for detonation and analysis.