WinRAR is subject to a critical path traversal vulnerability that permits remote code execution and is currently being exploited in the wild.

The flaw is a path traversal vulnerability (CWE-35) that allows an attacker to bypass directory restrictions when processing archive files. By crafting a malicious archive, an attacker can trigger arbitrary code execution on the host machine when a user opens the file, requiring no authentication from the attacker.

Successful exploitation of this vulnerability leads to full system compromise, allowing attackers to execute code with the privileges of the logged-in user. Given the CVSS score of 9.5, this represents a critical risk to organizational data integrity, confidentiality, and availability. The active exploitation of this flaw by threat actors increases the likelihood of ransomware deployment or persistent unauthorized access to corporate environments.

Immediate Action: Update all installations of WinRAR to version 7.13 or later immediately to resolve the path traversal flaw.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by WinRAR, such as command shells or PowerShell scripts, which may indicate an exploitation attempt.

Compensating Controls: Implement endpoint protection solutions capable of scanning compressed archives for malicious patterns and restrict the opening of untrusted RAR files received via email or external sources.

Public Exploit Available: Yes, multiple public proofs-of-concept are available via GitHub repositories.

Due to the critical severity and confirmed active exploitation of this vulnerability in the wild, organizations must prioritize patching all affected WinRAR instances. Given the presence of public exploit code and the inclusion of this CVE in the CISA KEV catalog, the risk of compromise is extremely high. Failure to update to version 7.13 places the organization at significant risk of system takeover and potential data loss.