Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-6218 | Directory Traversal RCE in RARLAB WinRAR RARLAB WinRAR contains a directory traversal flaw (CWE-22) in its handling of file paths within archive files, allowing a crafted archive path to traverse to unintended directories during extraction. Exploitation requires user interaction: the target must open a malicious file (e.g., a booby-trapped archive) or visit a malicious page. A successful attacker executes arbitrary code in the context of the current user, yielding full high-impact code execution on the endpoint (CVSS 3.0: 7.8, local attack vector with required user interaction). Any installation running an affected version of RARLAB WinRAR is exposed; the specific affected version range is not stated in the source data, so defenders should confirm against RARLAB's advisory. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-09, Google warned of active exploitation, public reporting ties the campaign to APT-C-08 and at least one other actor group, and EPSS stands at 90.5%. Do: Update WinRAR to the latest vendor release that addresses CVE-2025-6218 per RARLAB's advisory (the fixed version number is not provided in the source data), and treat this as urgent given the KEV listing and 90.5% EPSS. Warn users not to open archives from untrusted or unexpected sources, and inspect email-borne .rar/.zip attachments. Hunt for unusual child processes or file writes outside expected directories following archive extraction, and note U.S. federal civilian agencies must apply mitigations under BOD 22-01. | 7.8 | 91% | KEV PoC ×2 |
| masshundreds of millions of users/installations worldwide | |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution A path traversal flaw (CWE-35) in the Windows version of WinRAR allows attackers to achieve arbitrary code execution by delivering a specially crafted archive file that writes outside the expected location when it is opened or processed. Because the CVSS 4.0 vector indicates a local attack requiring user interaction, victims are typically infected by extracting or previewing a malicious archive received via phishing, a malicious download, or another delivery channel. A successful attacker gains the privileges of the user running WinRAR, providing an initial foothold that has been used for both espionage and ransomware operations. Anyone running the Windows version of WinRAR — one of the most widely deployed Windows desktop utilities — is affected, and CPE data additionally lists dtSearch as an affected vendor. Exploitation is confirmed in the wild by nation-state actors (e.g., the China-linked Amaranth-Dragon group per related reporting) and criminal actors including ransomware operators; the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-12 and carries a near-maximal 94.6% EPSS score. Do: Update WinRAR to the latest patched release from RARLAB on all Windows endpoints, prioritizing remediation per CISA KEV and BOD 22-01 requirements, and verify that dtSearch deployments bundling the affected component are also updated. Because exploitation requires a user to open or extract a crafted archive, warn users to treat unexpected archive files delivered by email or download with suspicion. Given confirmed ransomware use, hunt across user workstations — not just exposed servers — for suspicious archive-based infections and confirm the patched WinRAR version is installed. | 8.4 | 95% | KEV ransomware |
| masshundreds of millions of Windows users/devices (est.; RARLAB has historically claimed user counts in the hundreds of millions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | johnfashionaccess.com | " The C# trojan is designed to contact an external server ("johnfashionaccess[.]com") for command-and-control (C2) and enable keylogging, scr |
Full article602 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 10, 2025Vulnerability / Malware
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation to succeed, it requires a prospective target to visit a malicious page or open a malicious file.
"RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user," CISA said in an alert.
The vulnerability was patched by RARLAB with WinRAR 7.12 in June 2025. It only affects Windows-based builds. Versions of the tool for other platforms, including Unix and Android, are not affected.
"This flaw could be exploited to place files in sensitive locations — such as the Windows Startup folder — potentially leading to unintended code execution on the next system login," RARLAB noted at the time.
The development comes in the wake of multiple reports from BI.ZONE, Foresiet, SecPod, and Synaptic Security that the vulnerability has been exploited by three different threat actors tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon.
In an analysis published in August 2025, the Russian cybersecurity vendor said there are indications that GOFFEE may be exploited CVE-2025-6218 along with CVE-2025-8088 (CVSS score: 8.8), another path traversal flaw in WinRAR, in attacks targeting organizations in the country in July 2025 via phishing emails.
It has since emerged that the South Asia-focused Bitter APT has also weaponized the vulnerability to facilitate persistence on the compromised host and ultimately drop a C# trojan by means of a lightweight downloader. The attack leverages a RAR archive ("Provision of Information for Sectoral for AJK.rar") that contains a benign Word document and a malicious macro template.
"The malicious archive drops a file named Normal.dotm into Microsoft Word's global template path," Foresiet said last month. "Normal.dotm is a global template that loads every time Word is opened. By replacing the legitimate file, the attacker ensures their malicious macro code executes automatically, providing a persistent backdoor that bypasses standard email macro blocking for documents received after the initial compromise."
The C# trojan is designed to contact an external server ("johnfashionaccess[.]com") for command-and-control (C2) and enable keylogging, screenshot capture, remote desktop protocol (RDP) credential harvesting, and file exfiltration. It's assessed that the RAR archives are propagated via spear-phishing attacks.
Last but not least, CVE-2025-6218 has also been exploited by a Russian hacking group known as Gamaredon in phishing campaigns targeting Ukrainian military, governmental, political, and administrative entities to infect them with a malware referred to as Pteranodon. The activity was first observed in November 2025.
"This is not an opportunistic campaign," a security researcher who goes by the name Robin said. "It is a structured, military-oriented espionage and sabotage operation consistent with, and likely coordinated by, Russian state intelligence."
It's worth noting that the adversary has also extensively abused CVE-2025-8088, using it to deliver malicious Visual Basic Script malware and even deploy a new wiper codenamed GamaWiper.
"This marks the first observed instance of Gamaredon conducting destructive operations rather than its traditional espionage activities," ClearSky said in a November 30, 2025, post on X.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by December 30, 2025, to secure their networks.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/12/warning-winrar-vulnerability-cve-2025.html