CISA Warns of WinRAR 0-Day RCE Vulnerability Exploited in Attacks

A critical WinRAR zero-day (CVE-2025-6218) path-traversal vulnerability is being actively exploited to allow remote code execution by extracting files outside intended folders; the flaw carries a CVSS 9.8 rating and was added to CISA's Known Exploited Vulnerabilities catalog—users and organizations are urged to update WinRAR immediately or discontinue use until patched.