Rarlab

Vulnerability activity for Rarlab: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 4
Critical (CVSS 9+): 0
Exploited (CISA KEV): 1
With exploit code: 1

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

7.8HighDec 9, 2025RARLAB WinRAR Path traversal / file handlingCVE-2025-6218RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.Added to KEV Dec 9, 2025Exploited90% likelyExploit codeDetection
8.4HighAug 8, 2025RARLAB WinRAR Path traversal / file handlingCVE-2025-8088RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.Added to KEV Aug 12, 2025 · 4 days after publicationExploited95% likelyExploit codeDetection
7.8HighAug 23, 2023RARLAB WinRAR Code / command injectionCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.Added to KEV Aug 24, 2023 · 1 day after publicationExploited100% likelyExploit codeMetasploitDetection
9.8CriticalMay 9, 2022RARLAB UnRAR Path traversal / file handlingCVE-2022-30333RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.Added to KEV Aug 9, 2022 · 92 days after publicationExploited99% likelyExploit codeMetasploitDetection
7.8HighFeb 5, 2019RARLAB WinRAR Path traversal / file handlingCVE-2018-20250WinRAR Absolute Path Traversal vulnerability leads to Remote Code ExecutionAdded to KEV Feb 15, 2022 · 1,105 days after publicationExploited96% likelyExploit codeExploit-DB · Metasploit

Recent

6.2MediumApr 5, 2026Rarlab winrar Denial of serviceCVE-2019-25677WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.
7.8HighDec 9, 2025RARLAB WinRAR Path traversal / file handlingCVE-2025-6218RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.Exploited90% likelyExploit codeDetection
5.0MediumDec 5, 2025Rarlab rar Path traversal / file handlingCVE-2025-14111A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.20 build 128 is able to mitigate this issue. You should upgrade the affected c
6.1MediumNov 12, 2025Rarlab winrar XSSCVE-2025-52331Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.
8.4HighAug 8, 2025RARLAB WinRAR Path traversal / file handlingCVE-2025-8088RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.Exploited95% likelyExploit codeDetection
7.8HighAug 23, 2023RARLAB WinRAR Code / command injectionCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.Exploited100% likelyExploit codeMetasploitDetection
9.8CriticalMay 9, 2022RARLAB UnRAR Path traversal / file handlingCVE-2022-30333RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.Exploited99% likelyExploit codeMetasploitDetection
7.8HighFeb 5, 2019RARLAB WinRAR Path traversal / file handlingCVE-2018-20250WinRAR Absolute Path Traversal vulnerability leads to Remote Code ExecutionExploited96% likelyExploit codeExploit-DB · Metasploit

See every Rarlab entry on the dashboard.