CVE-2025-52331: Rarlab WinRAR XSS Vulnerability

CVE-2025-52331 Overview

CVE-2025-52331 is a cross-site scripting (XSS) vulnerability in the generate report functionality of Rarlab WinRAR 7.11. The generate report command incorporates archived file names directly into the HTML report without sanitization. Attackers can craft archives containing file names with embedded HTML or script payloads. When a user runs the report feature and opens the resulting HTML file, the injected code executes in the local browser context. Successful exploitation discloses user information such as the Windows username, the report output directory, and the client IP address. The issue is classified under [CWE-79] and requires user interaction.

Critical Impact
Attackers can exfiltrate local system context, including username, report path, and IP address, when a victim opens a maliciously crafted archive's generated HTML report.

Affected Products

Rarlab WinRAR 7.11
WinRAR builds bundling the vulnerable report generator
Windows systems executing the generate report feature on attacker-supplied archives

Discovery Timeline

2025-11-12 - CVE-2025-52331 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52331

Vulnerability Analysis

WinRAR's report generator writes an HTML document listing the contents of an archive. File names inside the archive are inserted into the HTML output without escaping angle brackets, quotes, or other markup-significant characters. An attacker who controls the archive contents can inject arbitrary HTML tags, including <script>, <img>, and <iframe> elements. When the victim opens the generated .html report in a browser, the injected markup runs under the file:// origin. This context permits reading local resources referenced by the report and issuing outbound requests carrying disclosed local data. Reported disclosures include the current Windows username, the absolute path of the report directory, and the machine's public IP address via callbacks to attacker-controlled servers. Exploitation requires the victim to (1) receive the crafted archive, (2) invoke the generate report action, and (3) open the resulting HTML file.

Root Cause

The report generator concatenates archive entry names into HTML output without applying HTML entity encoding or an equivalent output-context sanitizer. Any archive entry name containing markup characters is rendered as live HTML rather than text.

Attack Vector

The attack vector is network-delivered file with required user interaction. An attacker distributes a RAR or ZIP archive containing entries whose file names carry HTML payloads. Delivery mechanisms include email attachments, download links, and shared storage. Execution occurs only after the victim runs generate report and opens the produced HTML.

No verified public exploit code is available. See the GitHub Gist Code Snippet referenced by the advisory for technical details.

Detection Methods for CVE-2025-52331

Indicators of Compromise

Archive files whose internal entry names contain HTML tags such as <script, <img src=, <iframe, or onerror=.
HTML reports generated by WinRAR containing outbound references to unfamiliar domains or IP addresses.
Browser processes launched from WinRAR's report directory issuing unexpected network requests shortly after archive extraction.

Detection Strategies

Inspect newly created .html files in WinRAR report output paths for embedded <script> or event-handler attributes.
Correlate WinRAR.exe process activity with subsequent browser launches opening local HTML files and outbound HTTP requests.
Scan RAR and ZIP archives at email and web gateways for entry names containing angle brackets or JavaScript event handlers.

Monitoring Recommendations

Log and alert on browser processes loading file:// URLs that trigger DNS queries to external hosts within a short window.
Track version metadata for WinRAR installations across the fleet to identify hosts still running 7.11 or earlier.
Monitor DLP telemetry for outbound requests containing Windows usernames or local path fragments in URL parameters.

How to Mitigate CVE-2025-52331

Immediate Actions Required

Upgrade WinRAR to the latest version published by RARLAB that addresses the report generator sanitization defect.
Instruct users to avoid running the generate report feature on archives received from untrusted sources.
Block inbound archives at mail and web gateways when entry names contain HTML markup characters.

Patch Information

Refer to the vendor release notes at RARLAB New Features and WinRAR Version Updates for the fixed build addressing CVE-2025-52331. Deploy the updated installer through standard software distribution channels and remove prior 7.11 installations.

Workarounds

Disable or restrict use of the generate report functionality via user training and endpoint policy until patched.
Open any generated HTML report only in a sandboxed browser profile with scripting disabled for file:// origins.
Rename or extract archive contents before generating reports so entry names can be reviewed for markup characters.

bash

# Verify installed WinRAR version on Windows endpoints
reg query "HKLM\SOFTWARE\WinRAR" /v "exe64"
(Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.ProductVersion