WinRAR Path Traversal / Spoofed File Extension Code Execution
A vulnerability in RARLAB's WinRAR allows a crafted archive to execute arbitrary code when a user attempts to view what appears to be an innocuous file (e.g. a .jpg) inside the archive — a decoy folder with a matching name masks a malicious script that runs instead.
- Vendor
- RARLAB
- Product
- WinRAR
- CVSS
- 7.8
- EPSS (exploit probability)
- 99.8%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2023-38831 being exploited?
Yes. CISA added CVE-2023-38831 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 99.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2023-38831 is a code-execution vulnerability in WinRAR, the widely used Windows archive utility from RARLAB, patched in version 6.23 released August 2, 2023 and formally disclosed August 23, 2023. Researchers found that specially crafted ZIP archives could be built so that double-clicking what looked like a harmless file (such as a .jpg) inside the archive preview would instead execute a hidden malicious script, due to how WinRAR handled a decoy folder sharing the same name as the spoofed file.
Why it mattered
WinRAR is installed on hundreds of millions of Windows machines, many with automatic update prompts routinely dismissed by users — a huge, slow-patching install base is exactly the profile threat actors look for. Security researchers reported observing exploitation of this flaw in the wild in campaigns targeting cryptocurrency and stock trading forums even before the technical details were widely publicized, distributing malicious archives disguised as trading tools or account documents.
RARLAB’s fix in 6.23 changed how the archive-preview handling resolves file paths to prevent the spoofing. CISA added the CVE to its KEV catalog given confirmed active exploitation. Because WinRAR has no auto-update mechanism by default, remediation guidance emphasized manual upgrade to 6.23 or later. Full technical detail is in RARLAB’s release notes and at the NVD link above.
Other RARLAB WinRAR CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-6218 RARLAB WinRAR Path Traversal Vulnerability | [ HIGH ] | 7.8 | 90.5% | |
| CVE-2025-8088 RARLAB WinRAR Path Traversal Vulnerabilityransomware use | [ HIGH ] | 8.8 | 94.5% | |
| CVE-2018-20250 WinRAR Absolute Path Traversal Vulnerabilityransomware use | [ HIGH ] | 7.8 | 96.0% |
