RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability

A directory traversal vulnerability allowing remote code execution has been identified in RARLAB WinRAR. This issue arises from improper handling of file paths within archive files, enabling an attacker to craft a file path that traverses to unintended directories. Exploitation requires user interaction, as the target must open a malicious file or visit a harmful webpage. The vulnerability affects WinRAR versions prior to 7.11.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the user.

Remediation

RARLAB has released a patch for this vulnerability in WinRAR version 7.11. Users are advised to update to this version.