Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://jvn.jp/en/jp/JVN59547048/ | Third Party Advisory |
| https://www.win-rar.com/start.html?&L=0 | Release Notes |
Configurations
History
01 Jul 2025, 15:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rarlab winrar
Rarlab |
|
| References | () https://jvn.jp/en/jp/JVN59547048/ - Third Party Advisory | |
| References | () https://www.win-rar.com/start.html?&L=0 - Release Notes | |
| CPE | cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:* |
03 Apr 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-03 06:15
Updated : 2025-07-01 15:10
NVD link : CVE-2025-31334
Mitre link : CVE-2025-31334
JSON object : View
Products Affected
rarlab
- winrar
CWE
CWE-356
Product UI does not Warn User of Unsafe Actions