CISA Adds Actively Exploited WinRAR Vulnerability (CVE-2025-6218) to KEV Catalog

Based on the summary provided, on December 10, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-6218 to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. This vulnerability, with a CVSS score of 7.8, affects WinRAR software and is classified as a path traversal flaw that enables arbitrary code execution. Path traversal vulnerabilities occur when an application fails to properly sanitize user-supplied input, allowing attackers to access files outside the intended directory structure. In the context of archive utilities like WinRAR, this could involve maliciously crafted archive files containing path traversal sequences that, when extracted, place files in unintended locations on the file system. The summary indicates that versions of WinRAR prior to the corrected version are affected, but does not provide specific details on the exploitation conditions or the threat actors involved. Given the active exploitation status and the high CVSS score, organizations using WinRAR should prioritize patching to the latest version. Additionally, implementing defensive measures such as input validation, least privilege principles, and application whitelisting can help mitigate the risk of exploitation. Monitoring for unusual file system activity related to archive operations may also assist in detecting potential exploitation attempts. While the full original article may contain more information, the available summary clearly indicates a significant risk to unpatched systems. The widespread use of WinRAR in both personal and enterprise environments underscores the importance of prompt action to address this vulnerability.