RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability (CVE-2025-6218) Urgent Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-6218) is a critical directory traversal flaw (CWE-22) existing within the file path handling mechanism of RARLAB WinRAR. The root cause lies in the application's failure to properly sanitize and validate file paths contained within archive files during extraction. This allows specially crafted relative path sequences (such as '../') to bypass intended directory boundaries.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by constructing a malicious archive file containing files with manipulated directory traversal paths. The attack relies on user interaction, requiring the target to download and extract the malicious archive. Upon extraction, WinRAR traverses out of the target directory and writes malicious payloads (e.g., executable or script files) into sensitive system directories, such as the Windows Startup folder. These payloads are subsequently executed automatically when the system reboots or when triggered by user activity.

3. Infrastructure & Business Impact

This vulnerability has been added to the CISA KEV catalog, indicating active exploitation in the wild by threat actors (such as APT-C-08). Successful exploitation grants the attacker the same privileges as the active user, potentially leading to full endpoint compromise, lateral movement within the corporate network, data exfiltration, and ransomware deployment.