CVE catalog
CVE-2025-6218
rar: CVE-2025-6218
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 90.48% · Oct 25, 2026
RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rar | sid | 2:7.23-1 | not affected |
| Debian | rar | forky | 2:7.23-1 | not affected |
| Debian | rar | trixie | 2:7.11-1 | not affected |
| Debian | rar | bookworm | 2:7.01-1~deb12u1 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rar | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | rar | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | rar | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | rar | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rar]Not affected
Details (1)
2:7.01-1~deb12u1· amd64 · bookwormNot affected
dsa · rar · debian · bookworm
Observed:
References
- [https://security-tracker.debian.org/tracker/CVE-2025-6218]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1375.json]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS]