← Back

CVE-2025-31334

nvd nist
Published: Apr 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.8
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: vultures@jpcert.or.jp (Secondary)

Description

Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.

Affected (1)

Products: Rarlab: Winrar
Rarlab
1 product
Winrar
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Winrar
Before 7.11

Related CWEs

CWE-356
Product UI does not Warn User of Unsafe Actions
The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.

References (2)

Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
Release Notes

Timeline

No history available yet.