CVE-2025-6218: RARLAB WinRAR -- Path Traversal Code Execution

Background

WinRAR is one of the most widely used file archiving utilities worldwide, installed on hundreds of millions of Windows systems. Its ubiquity makes it a recurring target for vulnerability researchers and threat actors alike — malicious archives delivered via phishing or drive-by download can be weaponized against virtually any Windows user who has WinRAR installed.

CVE-2025-6218 is a path traversal vulnerability (CWE-22) in WinRAR that allows an attacker to place extracted files outside the intended destination directory, including in locations such as the Windows startup folder or application directories. CISA added this to the KEV catalog on 2025-12-09, confirming it is being actively exploited in the wild.

Path traversal vulnerabilities in archive utilities have a well-documented exploitation history — CVE-2018-20250 in WinRAR was widely exploited within days of disclosure, and this new variant follows a similar pattern of rapid weaponization.

Technical Mechanism

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). WinRAR processes archive entries and extracts them to a destination path. A maliciously crafted archive can include entries with filenames containing path traversal sequences (../ or absolute paths) that cause the extractor to write files outside the intended target directory.

# Malicious archive entry construction (Python conceptual)
import zipfile

with zipfile.ZipFile("malicious.rar", "w") as zf:
    # Path traversal: target Windows Startup folder
    traversal_path = "../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/payload.exe"
    zf.write("payload.exe", traversal_path)

# When user extracts to C:\Users\victim\Downloads\extracted\,
# payload lands in Startup folder and executes at next login

When the victim opens and extracts the crafted archive with WinRAR, the executable lands in a privileged location and executes automatically at next login or application launch, achieving code execution without any UAC prompt.

Real-World Exploitation Evidence

WinRAR path traversal vulnerabilities are reliable phishing lure weaponization vectors. The CISA KEV listing confirms this is being actively used in campaigns. Threat actors deliver malicious archives via email attachments, file-sharing platforms, and social engineering on gaming/software piracy communities. Post-exploitation typically includes credential stealer deployment, remote access trojan (RAT) installation, and persistence via startup folder entries.

Impact Assessment

• Code execution in the context of the current user at next login
• Persistence via Startup folder or application directory placement
• No elevated privileges required for exploitation
• Effective as a phishing payload delivery mechanism
• Potential for broader system compromise if combined with privilege escalation

Affected Versions

Remediation Steps

1. Update WinRAR to the latest version immediately via the official RARLAB site.
2. Train users to be cautious when opening archives from untrusted sources.
3. Consider deploying Windows AppLocker or WDAC policies to block execution from user-writable directories.
4. Enable Controlled Folder Access in Windows Defender to protect the Startup folder.
5. Implement email attachment filtering to block archive files from unknown senders.

Detection Guidance

Log Sources: Windows Event Logs (4688 process creation), Sysmon (Event ID 11 file create), endpoint EDR.

IOCs: WinRAR process writing files outside the selected extraction directory; new executables appearing in %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\; child processes spawned from WinRAR.

Sigma rule:

title: WinRAR Path Traversal Write to Startup Folder CVE-2025-6218
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: '\WinRAR.exe'
    TargetFilename|contains:
      - '\Start Menu\Programs\Startup\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2025-6218
• CISA KEV — CVE-2025-6218
• MITRE CVE — CVE-2025-6218