Link following in WinRAR - #VU136809
Published: July 2, 2026
Vulnerability identifier: #VU136809
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to place a symbolic link outside the destination folder.
The vulnerability exists due to improper link resolution in the extraction code when extracting a specially crafted RAR archive. A remote attacker can supply a specially crafted archive to place a symbolic link outside the destination folder.
The potential threat is limited to cases where another tool uses the created symbolic link to store files.
Affected software
WinRAR
Remediation
Install security update from vendor's website.
WinRAR - update to 7.23