CVE-2025-31334

State: Published
Severity: 6.8 Medium
Published: Apr 3, 2025
Updated: Apr 3, 2025
Reserved: Mar 27, 2025

Description

Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.

Scores

CVSS	Score	Vector	Source
3.0	6.8 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	jpcert

Weaknesses

CWE-356 Product UI does not warn user of unsafe actions

Affected Products

Product	Versions
WinRARRARLAB	prior to 7.11Affected

References

https://www.win-rar.com/start.html?&L=0
https://jvn.jp/en/jp/JVN59547048/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.