Attack list
7-Zip or WinRAR
6 attacked bugs
Attackers used 7-Zip or WinRAR bugs this year.
What to do
These don't update themselves. Download the newest version from the official website and install it over the old one.
Attackers keep using these against anything that hasn't updated. Updating closes them.
BugConfirmed in attacks
- RARLAB WinRAR bug: path traversalCVE-2025-6218Dec 9, 2025
- RARLAB WinRAR bug: path traversalCVE-2025-8088Aug 12, 2025
- 7-Zip bug: mark of the web bypassCVE-2025-0411Feb 6, 2025
- RARLAB WinRAR bug: code executionCVE-2023-38831Aug 24, 2023
- RARLAB UnRAR bug: directory traversalCVE-2022-30333Aug 9, 2022
- RARLAB WinRAR bug: absolute path traversalCVE-2018-20250Feb 15, 2022
From the US government's list of bugs confirmed in real attacks (CISA KEV). Check everything you use.