{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "winrar",
  "name": "WinRAR",
  "short_name": "WinRAR",
  "page_url": "https://patchgap.ai/is-my-winrar-up-to-date/",
  "minimum_safe_version": "7.13",
  "minimum_safe_version_source": [
   {
    "url": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5",
    "title": "WinRAR News: WinRAR 7.13 Final released (CVE-2025-8088)",
    "date": "2025-07-30",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": "7.13",
   "applies_to": "all platforms listed for this product",
   "source_incident": "winrar-attacked-path-bugs-2025",
   "sources": [
    {
     "url": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5",
     "title": "WinRAR News: WinRAR 7.13 Final released (CVE-2025-8088)",
     "date": "2025-07-30",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": true,
   "caveats": [],
   "text": "You're covered against everything listed here if you're on WinRAR 7.13 or newer."
  },
  "update_steps": {
   "windows": [
    "Go to win-rar.com/download.html (type the address yourself).",
    "Download the newest version and install it over the old one."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "RARLAB / win.rar GmbH",
  "category": "apps",
  "platforms": [
   "windows"
  ],
  "what_it_is": "A popular Windows app for opening .rar and .zip files.",
  "url": "https://patchgap.ai/is-my-winrar-up-to-date/",
  "json_url": "https://patchgap.ai/products/winrar.json",
  "official_site": "https://www.win-rar.com/",
  "official_download": "https://www.win-rar.com/download.html",
  "how_it_updates": "WinRAR does not update itself. Download the newest version from win-rar.com and install it over the old one.",
  "check": {
   "windows": {
    "menu_path": "Open WinRAR > Help > About WinRAR.",
    "command": "(Get-Item \"$env:ProgramFiles\\WinRAR\\WinRAR.exe\").VersionInfo.ProductVersion",
    "shell": "PowerShell",
    "read_only": true
   }
  },
  "open_incidents": [
   "winrar-attacked-path-bugs-2025"
  ]
 },
 "incidents": [
  {
   "id": "winrar-attacked-path-bugs-2025",
   "url": "https://patchgap.ai/incidents/winrar-attacked-path-bugs-2025/",
   "path": "/incidents/winrar-attacked-path-bugs-2025/",
   "json_url": "https://patchgap.ai/incidents/winrar-attacked-path-bugs-2025.json",
   "title": "WinRAR: opening a bad archive could drop a hidden program on your PC, and attackers used it",
   "category": "apps",
   "platforms": [
    "windows"
   ],
   "products": [
    "winrar"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists both bugs as used in real attacks (CVE-2025-8088 added Aug 12, 2025; CVE-2025-6218 added Dec 9, 2025).",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-07-30",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-6218",
    "CVE-2025-8088"
   ],
   "summary": "WinRAR opens .rar and .zip files. Two bugs let a booby-trapped archive save files outside the folder you chose, for example into your Startup folder so a bad program runs next time you sign in. Attackers sent such files by email. Version 7.13 fixes both. WinRAR does not update itself.",
   "am_i_affected": "You are at risk if WinRAR on Windows is older than 7.13. Mac and Android versions are not affected.",
   "action": "Install WinRAR 7.13 or newer from win-rar.com",
   "affected": [
    {
     "product": "winrar",
     "product_name": "WinRAR",
     "platform": "windows",
     "affected_versions": "WinRAR for Windows before 7.13 (one bug before 7.12)",
     "fixed_version": "7.13",
     "fixed_min": "7.13",
     "fix_note": null,
     "fixed_source_urls": [
      "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5"
     ],
     "check": {
      "menu_path": "Open WinRAR > Help > About WinRAR.",
      "command": "(Get-Item \"$env:ProgramFiles\\WinRAR\\WinRAR.exe\").VersionInfo.ProductVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.win-rar.com/download.html"
    }
   ],
   "fix_steps": [
    "Go to win-rar.com (type the address yourself) and open Download.",
    "Download WinRAR 7.13 or newer and run the installer over your old version.",
    "Do not open archives from emails you did not expect."
   ],
   "official_patch_links": [
    {
     "label": "WinRAR: official download",
     "url": "https://www.win-rar.com/download.html"
    },
    {
     "label": "WinRAR 7.13 release note",
     "url": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5",
     "title": "WinRAR News: WinRAR 7.13 Final released (CVE-2025-8088)",
     "date": "2025-07-30",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9",
     "title": "WinRAR News: WinRAR 7.12 Beta 1 released (fix for CVE-2025-6218)",
     "date": "2025-06-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-6218 (added 2025-12-09)",
     "date": "2025-12-09",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-8088 (added 2025-08-12)",
     "date": "2025-08-12",
     "kind": "cisa",
     "official": true
    }
   ]
  }
 ]
}