{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:39:04.690Z",
  "tag": {
    "id": "rarlab",
    "label": "RARLAB (WinRAR)",
    "isStack": false,
    "url": "https://pwn.watch/t/rarlab",
    "feed": "https://pwn.watch/t/rarlab/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "rarlab-winrar-cve-2025-6218",
      "title": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-6218",
      "json": "https://pwn.watch/i/rarlab-winrar-cve-2025-6218.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "RARLAB WinRAR",
      "tags": [
        "rarlab",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-6218"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-09",
      "closedAt": "2025-12-09",
      "updatedAt": "2025-12-09",
      "summary": "RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. Added to CISA KEV on 2025-12-09.",
      "xPost": null
    },
    {
      "slug": "rarlab-winrar-cve-2025-8088",
      "title": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088",
      "json": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "RARLAB WinRAR",
      "tags": [
        "rarlab",
        "windows",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-8088"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-08-12",
      "closedAt": "2025-08-12",
      "updatedAt": "2025-08-12",
      "summary": "RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Added to CISA KEV on 2025-08-12.",
      "xPost": null
    },
    {
      "slug": "winrar-zero-day-cve-2023-38831",
      "title": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831",
      "json": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "RARLAB WinRAR",
      "tags": [
        "winrar",
        "rarlab",
        "windows",
        "zero-day",
        "rce",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-38831"
      ],
      "affectedVersions": [
        "Before 6.23 (NVD)"
      ],
      "fixedVersions": [
        "6.23"
      ],
      "startedAt": "2023-08-02",
      "closedAt": "2023-10-18",
      "updatedAt": "2023-10-18",
      "summary": "WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "rarlab-winrar-cve-2025-6218",
      "incidentTitle": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-09",
      "title": "CISA added CVE-2025-6218 to the KEV catalog (due 2025-12-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-6218"
    },
    {
      "incident": "rarlab-winrar-cve-2025-8088",
      "incidentTitle": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-12",
      "title": "CISA added CVE-2025-8088 to the KEV catalog (due 2025-09-02).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Google TAG: government-backed actors exploiting the WinRAR bug",
      "body": null,
      "sourceUrl": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-24",
      "title": "CISA adds CVE-2023-38831 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-23",
      "title": "Group-IB: zero-day exploited since April 2023 against traders",
      "body": null,
      "sourceUrl": "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-02",
      "title": "WinRAR 6.23 released with the fix",
      "body": null,
      "sourceUrl": "https://www.rarlab.com/rarnew.htm",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    }
  ]
}