Peter Košinár

**Name of the Vulnerable Software and Affected Versions** WinRAR versions prior to 7.13 **Description** A path traversal vulnerability in the Windows version of WinRAR allows attackers to execute arbitrary code by crafting malicious archive files. By using a specially crafted file path within an archive, the extraction process can be forced to write files outside the intended target directory, including system folders such as the Startup folder. This issue has been exploited in the wild by Russian APT groups, including Amaranth-Dragon and Gamaredon, to target government networks, defense contractors, and critical infrastructure in NATO countries and Southeast Asia. These actors have used the flaw to silently install malware and maintain persistence on victim systems. **Recommendations** Update WinRAR to version 7.13 or newer.