CVE-2025-6218: RARLAB WinRAR Path Traversal Vulnerability

Q: How do I fix CVE-2025-6218?

winrar: upgrade to 7.12. Exact commands for each OS are on this page.

Q: Is CVE-2025-6218 being exploited?

Yes. CVE-2025-6218 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2025-6218 affect?

CVE-2025-6218 affects winrar. Severity is high (CVSS 7.8). RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerabili

Q: How urgent is CVE-2025-6218?

Priority 82/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Patch now

HIGH 7.8EXPLOITEDUPGRADE

CVE-2025-6218 is a high-severity flaw (CVSS 7.8) affecting winrar, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to travers

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	90.5% (top 1%)
CISA exploited list	Yes, fix due 2025-12-30
Weakness	CWE-22
Published	2025-06-21
Last modified	2026-06-17

Publisher (CNA): Zero Day Initiative · Vendor: rarlab

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-06-21 01:15 UTCPublished CVE record published
2025-12-09Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-12-30Deadline CISA due date for US federal agencies to patch
2026-06-17 10:01 UTCUpdated Record last modified

rarlab winrar UPGRADE

Affected: < 7.12

Fixed in: 7.12

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy winrar || rpm -q winrar || winrar --version

2. UPGRADE to 7.12 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade winrar

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade winrar

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · fips-provider-next · FIXED · 1.5.3-3.eln159 · FEDORA-2026-3ce99ec7df · source

sudo dnf upgrade --advisory=FEDORA-2026-3ce99ec7df

Fedora 46 · rubygem-webmock · FIXED · 3.26.1-3.fc46 · FEDORA-2026-bb57b4d095 · source

sudo dnf upgrade --advisory=FEDORA-2026-bb57b4d095

Debian 12 · rar · NOT AFFECTED

Debian 13 · rar · NOT AFFECTED

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: skimask1690/CVE-2025-6218-POC (30 stars)
GitHub PoC: absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE (19 stars)
GitHub PoC: speinador/CVE-2025-6218_WinRAR (16 stars)
Write-up: www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-s
GitHub PoC: ignis-sec/CVE-2025-6218

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-6218?

winrar: upgrade to 7.12. Exact commands for each OS are on this page.

Is CVE-2025-6218 being exploited?

Yes. CVE-2025-6218 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-6218 affect?

CVE-2025-6218 affects winrar. Severity is high (CVSS 7.8). RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerabili

How urgent is CVE-2025-6218?

Priority 82/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Software pages

WinRAR vulnerabilities

Related CVEs

CVE-2025-8088 HIGH 8.8 EXPLOITED UPGRADE UPGRADE RARLAB WinRAR Path Traversal Vulnerability
CVE-2019-25677 MEDIUM 6.2 UPGRADE WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by
CVE-2025-52331 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows at
CVE-2025-31334 MEDIUM 6.8 UPGRADE Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link tha
CVE-2024-36052 HIGH 7.5 UPGRADE RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences,

References

← Back to latest CVEs