Using WinRAR? Update now to avoid falling victim to this file path flaw
Windows versions of WinRAR need to be updated to avoid a serious flaw that could let hackers run code
Researchers have spotted a serious flaw in file archiving tool WinRAR that could allow hackers to run code on systems.
WinRAR's developer RARLAB has already issued a patch, along with advice to update the software immediately.
Spotted by a researcher working with Trend Micro's Zero Day Initiative, the directory traversal remote code execution (RCE) vulnerability only affected Windows versions of the software.
This is due to how WinRAR manages file paths in archives, researchers said. Unix and Android versions aren’t affected.
"A crafted file path can cause the process to traverse to unintended directories," Trend Micro's Zero Day Initiative (ZDI) said in an advisory. "An attacker can leverage this vulnerability to execute code in the context of the current user."
The vulnerability was reported by ZDI to RARLAB on June 5th, with the two organizations working on a coordinated advisory release two weeks later.
How the WinRAR flaw works
A RARLAB advisory noted that the flaw could be exploited to cause files to be written outside the intended directory.
"This flaw could be exploited to place files in sensitive locations — such as the Windows Startup folder — potentially leading to unintended code execution on the next system login," the developer's advisory noted.
The ZDI advisory added that hackers would need to trick victims into opening a dodgy file or clicking a malicious link in order to take advantage of the flaw.
"This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR," the advisory added.
"User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file."
Update now
RARLAB said anyone using the Windows version of WinRAR should update to newly released version 7.12 to resolve the serious flaw.
"We encourage all users to update their software to the latest version," the advisory noted.
Alongside the file path flaw, the updated version of WinRAR also addressed an HTML injection vulnerability in the "generate report" feature.
"Older versions of WinRAR’s 'Generate Report' feature included archived file names in the generated HTML without sanitization, allowing file names with HTML tags to be injected into the report," the company said.
Beyond the security patches, the latest version also includes improved testing of Recover Volumes to help ensure integrity of backups, and preservation of nanosecond timestamps in Unix file records, alongside other improvements.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
UK channel partners to increase data-driven innovation for growth in 2026News The latest research from Westcon-Comstor has revealed that almost half of UK channel firms plan to invest in data-led offerings over the coming year
-
Dell PowerEdge XE vs Dell PowerEdge R – which one is right for your business?The Dell PowerEdge family can meet all enterprise server requirements but for maximum deployment efficiency, leaders should know which models to put where
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
NHS supplier DXS International confirms cyber attack – here’s what we know so farNews The NHS supplier says front-line clinical services are unaffected
-
LastPass hit with ICO fine after 2022 data breach exposed 1.6 million users – here’s how the incident unfoldedNews The impact of the LastPass breach was felt by customers as late as December 2024
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
Trend Micro issues warning over rise of 'vibe crime' as cyber criminals turn to agentic AI to automate attacksNews Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations and accelerate attacks.
-
Cyber budget cuts are slowing down, but that doesn't mean there's light on the horizon for security teamsNews A new ISC2 survey indicates that both layoffs and budget cuts are on the decline
-
NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to knowNews Many organizations see prompt injection as just another version of SQL injection - but this is a mistake
-
Chinese hackers are using ‘stealthy and resilient’ Brickstorm malware to target VMware servers and hide in networks for months at a timeNews Organizations, particularly in the critical infrastructure, government services, and facilities and IT sectors, need to be wary of Brickstorm
