The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-6218, a path traversal vulnerability in WinRAR for Windows, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed exploitation by multiple advanced persistent threat (APT) groups. Read this Cybersecurity Threat Advisory now to mitigate your risk.
What is the threat?
CVE-2025-6218 has a CVSS rating of 7.8 and stems from improper handling of archive contents, allowing attackers to craft malicious RAR files that write to arbitrary locations on the victim’s filesystem. This bypasses the intended extraction path and can lead to persistent compromise.
Why is it noteworthy?
Exploitation requires user interaction—typically opening a malicious RAR file delivered via phishing or visiting a booby-trapped webpage. Once triggered, attackers can achieve persistence by dropping executables or scripts in the Windows Startup folder or replacing templates like Normal.dotm in Microsoft Word to auto-run malicious macros.
APT groups including GOFFEE, Bitter, and Gamaredon are actively leveraging this flaw for espionage, malware deployment, and sabotage.
What is the exposure or risk?
All Windows versions of WinRAR prior to 7.12 are vulnerable. Successful exploitation can result in:
- Full control of the affected endpoint.
- Installation of backdoors or trojans that survive reboot.
- Lateral movement within networks.
- Theft of sensitive data and credentials.
- Long-term intelligence gathering.
What are the recommendations?
Barracuda recommends the following actions to limit the impact of the vulnerability:
- Patch immediately to WinRAR 7.12 or later.
- Disable macros by default; allow only signed macros.
- Block or quarantine RAR attachments from untrusted sources.
- Configure EDR to detect suspicious file creation in sensitive locations.
- Block known command-and-control (C2) domains.
References
For more in-depth information about the recommendations, please visit the following links:
- https://thehackernews.com/2025/12/warning-winrar-vulnerability-cve-2025.html
- https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit/
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.