Read the docs
TI-2023-20115 Aliases CVE-2023-38831GHSA-w5x7-vwr2-4x27

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts…

Priority CRITICAL 93Exploited in the wildCWE-351Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-345.

Summary

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Why it matters now

Exploitation Active In CISA KEV since 2023-08-24CISA due date 2023-09-14Known ransomware use
EPSS 0.99815 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*before 6.23VulnerableRARLAB
  • cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:* Versions before 6.23 Vulnerable ·RARLAB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-08-24 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-38831
  3. 2026-10-03 Alias added: GHSA-w5x7-vwr2-4x27

References

Exploit 4

Other 1

  • TI-2025-07400 Path traversal vulnerability in WinRAR KEVCVSS 4.0HIGH 8.4
  • TI-2025-05626 Path traversal in RARLAB WinRAR KEVCVSS 3.0HIGH 7.8
  • TI-2018-14356 Path traversal in Check Point Software Technologies Ltd. WinRAR KEVCVSS 3.1HIGH 7.8
  • TI-2024-23905 RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via… CVSS 3.1HIGH 7.5
  • TI-2024-22371 RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the… CVSS 3.1HIGH 7.1
  • TI-2019-15730 WinRAR 5.61 Denial of Service via Malformed Language File CVSS 4.0MEDIUM 6.9
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences