Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

RARLAB: actively exploited vulnerabilities

5 vulnerabilities in RARLAB products (WinRAR, UnRAR) are in CISA’s catalog of exploited vulnerabilities. Last added: December 9, 2025.

By category

Add just one RARLAB category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • WinRAR 4 vulnerabilities · Office and PDF
  • UnRAR 1 vulnerability · Office and PDF

Name used by CISA: RARLAB. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this RARLAB list.

  1. Rank 1RARLAB WinRAR

    CVE-2025-6218

    RARLAB WinRAR Path Traversal Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Dec 9, 2025
    CISA deadline
    21 days
    CVSS severity
    7.8 (high)

  2. Rank 2RARLAB WinRAR

    CVE-2025-8088

    Ransomware

    RARLAB WinRAR Path Traversal Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 12, 2025
    CISA deadline
    21 days
    CVSS severity
    8.8 (high)

  3. Rank 3RARLAB WinRAR

    CVE-2023-38831

    Ransomware

    RARLAB WinRAR Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 24, 2023
    CISA deadline
    21 days
    CVSS severity
    7.8 (high)

  4. Rank 4RARLAB WinRAR

    CVE-2018-20250

    RansomwareCVE from 2018, added in 2022

    WinRAR Absolute Path Traversal Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Feb 15, 2022
    CISA deadline
    181 days
    CVSS severity
    7.8 (high)

  5. Rank 5RARLAB UnRAR

    CVE-2022-30333

    Ransomware

    RARLAB UnRAR Directory Traversal Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 9, 2022
    CISA deadline
    21 days
    CVSS severity
    7.5 (high)

Follow and verify

Get new RARLAB vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.