Read the docs
TI-2025-12893 Aliases CVE-2025-14111GHSA-446c-49cw-x44x

Rarlab RAR App com.rarlab.rar path traversal

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.20 build 128 is able to mitigate this issue. You should upgrade the affected component. The vendor responded very professional: "This is the real vulnerability affecting RAR for Android only. WinRAR and Unix RAR versions are not affected. We already fixed it in RAR for Android 7.20 build 128 and we publicly mentioned it in that version changelog. (...) To avoid confusion among users, it would be useful if such disclosure emphasizes that it is RAR for Android only issue and WinRAR isn't affected."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00698 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed RAR App (Rarlab): 7.20 build 128

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RARLABRAR App7.11 Build 1277.20 build 128Patch availableCNA
  • RAR App VendorRARLAB Affected 7.11 Build 127 Fixed in 7.20 build 128 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rarlab:rar:*:*:*:*:*:*:*:*up to 7.11VulnerableRARLAB
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
  • cpe:2.3:a:rarlab:rar:*:*:*:*:*:*:*:* Versions up to 7.11 Vulnerable ·RARLAB
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google

Remediation

  • Fix · CNA RAR App (Rarlab) Fixed in 7.20 build 128

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14111
  2. 2026-10-03 Alias added: GHSA-446c-49cw-x44x
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2014-08148 Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences