CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation
Detects exploitation of CVE-2025-6218, a path traversal vulnerability in RARLAB WinRAR. Attackers can craft malicious archive files that, when extracted, write files outside the intended extraction directory, enabling arbitrary file placement on the victim system. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to code execution, persistence, or privilege escalation by dropping malicious files to sensitive locations such as startup folders, system directories, or application data paths.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- RARLAB
- Product
- WinRAR
Weakness (CWE)
Timeline
- Disclosed
- December 9, 2025
CVSS
What is CVE-2025-6218 CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation?
CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation (CVE-2025-6218) maps to the Initial Access and Execution and Persistence tactics — the adversary is trying to get into your network in MITRE ATT&CK.
This page provides production-ready detection logic for CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Microsoft Sentinel DeviceFileEvents. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
let suspiciousPaths = dynamic(['\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup', '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup', '\\Windows\\System32\\', '\\Windows\\SysWOW64\\', '\\Windows\\Tasks\\']);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WinRAR.exe" or InitiatingProcessParentFileName =~ "WinRAR.exe"
| where ActionType in ("FileCreated", "FileModified")
| extend FolderPathLower = tolower(FolderPath)
| where FolderPathLower has_any (suspiciousPaths) or FolderPath matches regex @'\.\.[\\/]'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256, InitiatingProcessAccountName
| extend RiskIndicator = case(
FolderPathLower has "startup", "DropInStartupFolder",
FolderPathLower has "system32", "DropInSystem32",
FolderPathLower has "syswow64", "DropInSysWOW64",
FolderPathLower has "\\tasks\\", "DropInTasksFolder",
"PathTraversalSuspected"
)
| order by TimeGenerated descDetects WinRAR writing files to sensitive directories outside a normal extraction path, indicative of CVE-2025-6218 path traversal exploitation.
Data Sources
Required Tables
False Positives
- Legitimate WinRAR installations updating themselves to system paths
- IT administrators extracting archives to system directories for deployment
- Software installers packaged as RAR archives that write to expected system paths
Sigma rule & cross-platform mapping
The detection logic for CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation (CVE-2025-6218) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2025-6218
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WinRAR Path Traversal to Startup Folder
Expected signal: Sysmon Event ID 11 (FileCreate) with Image=WinRAR.exe and TargetFilename pointing to the Startup folder path
- Test 2WinRAR Extraction with Relative Path Traversal Sequence
Expected signal: Sysmon Event ID 11 with TargetFilename containing path traversal sequence and WinRAR.exe as the initiating process
- Test 3WinRAR Drop Executable to Windows Tasks Directory
Expected signal: Sysmon Event ID 11 (FileCreate) with Image containing WinRAR.exe and TargetFilename matching C:\Windows\Tasks\*
Unlock Pro Content
Get the full detection package for CVE-2025-6218 including response playbook, investigation guide, and atomic red team tests.