Skip to content
feed: live about
>_ 0dayNews
Vendor

RARLAB / WinRAR

Vulnerabilities in RARLAB's WinRAR, the ubiquitous Windows archive utility — bugs here are attractive to attackers because a single malicious archive can compromise any of WinRAR's hundreds of millions of installs.

CVEs
CVE-2023-38831
[ HIGH ] CVSS 7.8 kev

WinRAR Path Traversal / Spoofed File Extension Code Execution

A vulnerability in RARLAB's WinRAR allows a crafted archive to execute arbitrary code when a user attempts to view what appears to be an innocuous file (e.g. a .jpg) inside the archive — a decoy folder with a matching name masks a malicious script that runs instead.

RARLAB / WinRAR
Articles
~/articles/2026-07-05-winrar-path-traversal-cve-2023-38831
The WinRAR Bug That Hid a Malicious Script Behind a Fake Photo
Explainer
rarlab

The WinRAR Bug That Hid a Malicious Script Behind a Fake Photo

CVE-2023-38831 let a booby-trapped archive execute code when a user clicked what looked like a harmless image file — exploited against trading forums before the technical details were widely known.

read →