Key Takeaways

  • CISA has added CVE-2025-6218 to its Known Exploited Vulnerabilities catalog following evidence of active attacks.
  • RARLAB fixed the Windows-only path traversal vulnerability in WinRAR 7.12 in June 2025.
  • GOFFEE, Bitter, and Gamaredon have reportedly used the flaw in phishing operations involving espionage, persistence, credential theft, and destructive malware.

The U.S. Cybersecurity and Infrastructure Security Agency has added a WinRAR vulnerability tracked as CVE-2025-6218 to its Known Exploited Vulnerabilities Catalog, elevating a desktop application flaw into a federal patching priority. The designation reflects evidence that attackers are already exploiting the bug rather than merely experimenting with a proof of concept.

CVE-2025-6218 carries a CVSS score of 7.8 and affects Windows versions of RARLAB WinRAR. The path traversal vulnerability can allow an attacker to place files outside the location where an archive is expected to extract its contents. In a successful attack, code runs with the privileges of the current user.

There is still a user-interaction requirement. A prospective victim generally needs to visit a malicious page or open a malicious file. That limitation may reduce the likelihood of automated exploitation, but it fits neatly into spear-phishing campaigns, where attackers build convincing messages around business documents, government requests, or other targeted material.

RARLAB addressed the issue in WinRAR 7.12 in June 2025. Unix and Android versions are not affected. Organizations running older Windows builds of WinRAR should upgrade, while security teams may also want to identify unmanaged installations that fall outside normal software deployment processes.

Archive utilities frequently bypass visibility in application inventories, yet employees use them to handle files arriving through email, collaboration systems, downloads, and third-party exchanges. If an extraction process directs an attacker-controlled file to a sensitive directory, it creates an immediate compromise vector.

For CVE-2025-6218, one potential destination is the Windows Startup folder. A malicious archive can place a file there so that it executes when the user next logs in. The weakness can also support more application-specific persistence techniques. The NIST National Vulnerability Database classifies the underlying issue as path traversal, highlighting improper pathname handling as the central technical problem.

Reports from BI.ZONE, Foresiet, SecPod, and Synaptic Security have connected exploitation to threat actors such as GOFFEE (also known as Paper Werewolf), Bitter (also known as APT-C-08 or Manlinghua), and Gamaredon. Their activity suggests the vulnerability has value across different operational goals and target regions.

GOFFEE reportedly used CVE-2025-6218 alongside CVE-2025-8088, another WinRAR path traversal vulnerability with a CVSS score of 8.8, in phishing attacks against Russian organizations in July 2025. Google Threat Intelligence Group reported widespread exploitation of CVE-2025-8088 beginning as early as July 18, 2025. RARLAB fixed that flaw in WinRAR 7.13 on July 30, 2025.

Bitter used a malicious archive named "Provision of Information for Sectoral for AJK.rar" containing a benign Word document and a malicious macro template. According to Foresiet, extraction placed Normal.dotm into Microsoft Word's global template path. Because Word loads that template when it opens, the technique established persistence and enabled malicious macro code to run beyond the original phishing interaction.

The resulting C# trojan contacted johnfashionaccess[.]com for command and control. Its reported capabilities included keylogging, screenshot capture, remote desktop protocol credential harvesting, and file exfiltration. That is a broad collection toolkit from what initially looks like an ordinary compressed attachment.

Gamaredon, meanwhile, exploited CVE-2025-6218 in campaigns targeting Ukrainian military, governmental, political, and administrative entities. Activity first observed in November 2025 delivered Pteranodon malware. The group also abused CVE-2025-8088 to distribute Visual Basic Script malware and GamaWiper, marking a shift from traditional espionage toward destructive operations.

Federal Civilian Executive Branch agencies were required to apply the relevant fixes by December 30, 2025. For other enterprises, the KEV listing offers a practical prioritization signal. Security teams should update WinRAR, search endpoints for outdated installations, examine suspicious archive extraction activity, and review persistence locations such as Startup folders and Microsoft Word template directories. User awareness still matters, but patching closes the underlying route attackers have repeatedly turned into an operational foothold.