CVE-2025-6218 is a directory traversal vulnerability in WinRAR's handling of file paths stored inside archives: a crafted archive can force extraction to an attacker-chosen location instead of the folder the user picked, and the South Asia-focused espionage group APT-C-08 (Bitter) has used it in spear-phishing campaigns to drop persistence files into victims' Windows Startup folder.
Vulnerability summary
7.8
High
90.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-06-21
Published
Vulnerability ID: CVE-2025-6218 · Source: CNA (Trend Micro ZDI, Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| RARLAB WinRAR (Windows builds; RAR, UnRAR, portable UnRAR source and UnRAR.dll on Windows) | cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:* | before 7.12 (fixed in 7.12 Beta 1); Unix/Linux versions of RAR/UnRAR are not affected |
What this means
CVE-2025-6218 is a path/directory traversal vulnerability (CWE-22) disclosed by Trend Micro's Zero Day Initiative. NVD's description states it "allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR" and that "the specific flaw exists within the handling of file paths within archive files"; user interaction is required because the target must open a malicious archive or visit a malicious page (NVD).
The only CVSS data on record is a Secondary score submitted by Trend Micro ZDI: CVSS v3.0 7.8 (high), vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. NVD has not published its own independent Primary metric for this CVE, so this page reports the ZDI figure honestly as not NVD-confirmed rather than attributing it to NVD (NVD).
ZDI's advisory (ZDI-25-409) credits researcher whs3-detonator, records vendor notification on 2025-06-05 and public disclosure on 2025-06-19 (ZDI-25-409). RARLAB's own release notes for WinRAR 7.12 Beta 1 (dated June 10, 2025) describe the fix: "When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of user specified path," and the notes state this affects Windows only, with Unix builds unaffected (RARLAB release notes).
CISA added CVE-2025-6218 to the Known Exploited Vulnerabilities catalog, with a required-action due date of 2025-12-30 (CISA KEV).
Security researchers tracking the campaign attribute active exploitation to APT-C-08 (also tracked as Bitter), a suspected South Asian threat group active since at least 2013 that targets government, energy and military organizations in South Asia. The documented chain uses spear-phishing emails with malicious RAR attachments that exploit the directory traversal to drop files into the Windows Startup folder, combined with macro-based persistence and custom malware families (ZxxZ, WmRAT, MiyaRAT) for HTTPS-based command and control; the campaign was still active as of the November 2025 write-up, helped by the fact that WinRAR has no auto-update mechanism (SecPod).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.9048 (99.800th percentile), reflecting the documented, ongoing targeted exploitation (FIRST EPSS).
Because WinRAR does not auto-update, every Windows installation should be manually upgraded to 7.12 or later, and organizations that handle RAR attachments from external sources should treat any pre-7.12 installation as a standing spear-phishing risk.
Evidence
- Directory traversal in WinRAR's archive path handling lets a crafted archive write an extracted file outside the user-chosen path, enabling code execution; requires user interaction (opening the archive). — NVD
- Only CVSS data on record is a Trend Micro ZDI Secondary score, CVSS v3.0 7.8 (high), vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no NVD Primary metric published. — NVD
- ZDI-25-409: vendor notified 2025-06-05, publicly disclosed 2025-06-19, credited to researcher whs3-detonator. — Zero Day Initiative (ZDI-25-409)
- Fixed in WinRAR 7.12 Beta 1 (released June 10, 2025); affects Windows builds of WinRAR/RAR/UnRAR/UnRAR.dll only, not Unix. — RARLAB release notes
- Added to the CISA Known Exploited Vulnerabilities catalog, required-action due date 2025-12-30. — CISA KEV
- APT-C-08 (Bitter) used this vulnerability in spear-phishing campaigns against South Asian government targets, dropping files into the Windows Startup folder; campaign still active as of November 2025. — SecPod
- EPSS score is 0.9048 (99.800th percentile) as of 2026-10-29. — FIRST EPSS
