CVE-2025-60835 Overview
CVE-2025-60835 is a path traversal vulnerability in the unrar.dll component shipped with IZArc v4.6. Attackers can craft a malicious RAR archive that, when extracted, writes files outside the intended destination directory. The flaw enables arbitrary file placement on the target file system through directory traversal sequences embedded in archive entry names.
Critical Impact
A specially crafted RAR archive processed by IZArc v4.6 can write files to attacker-controlled locations outside the extraction directory, enabling code execution through overwrites of startup, configuration, or binary files.
Affected Products
- IZArc v4.6
- unrar.dll component bundled with IZArc v4.6
- Windows systems using IZArc v4.6 for archive extraction
Discovery Timeline
- 2026-07-22 - CVE-2025-60835 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-60835
Vulnerability Analysis
The vulnerability resides in the unrar.dll library used by IZArc v4.6 to process RAR archives. When the extractor decompresses archive entries, it fails to properly sanitize file path components inside the archive. An attacker can embed traversal sequences such as ..\..\ in entry names, causing the extractor to write files outside the target extraction directory.
Path traversal in archive extractors is commonly categorized as a "Zip Slip" style flaw. The extractor trusts archive-supplied filenames when constructing the output path. Without canonicalization and validation against the extraction root, relative path segments escape the intended boundary.
Successful exploitation results in arbitrary file write on the host. Attackers can drop payloads into the Windows Startup folder, overwrite scheduled task definitions, or replace DLLs loaded by other processes to achieve code execution in the user's security context.
Root Cause
The root cause is missing validation of archive entry paths before file creation. The unrar.dll extraction routine concatenates the archive-supplied name with the destination path without stripping or rejecting .. sequences and without verifying that the resolved path stays within the extraction directory.
Attack Vector
An attacker delivers a crafted RAR archive to the victim through phishing, a compromised download, or a file-sharing channel. When the user opens or extracts the archive with IZArc v4.6, unrar.dll writes the malicious entries to attacker-chosen paths. Exploitation requires user interaction to trigger extraction but no elevated privileges beyond those of the extracting user.
The technical mechanism and proof-of-concept references are documented in the GitHub CVE-2025-60835 Reference and the associated GitHub Commit Log.
Detection Methods for CVE-2025-60835
Indicators of Compromise
- Files written outside of the user-selected extraction directory following an IZArc extraction event.
- Unexpected files appearing in sensitive locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ shortly after archive extraction.
- RAR archives containing entries whose filenames include ..\ or ../ sequences.
- Process activity from IZArc.exe writing to paths outside the chosen destination folder.
Detection Strategies
- Inspect RAR archive listings for entries containing directory traversal sequences before extraction.
- Monitor file creation events where the parent process is IZArc.exe and the destination is outside a user-designated extraction root.
- Correlate archive extraction events with subsequent writes to autostart, Task Scheduler, or system32 directories.
Monitoring Recommendations
- Enable Windows Sysmon Event ID 11 (FileCreate) filtering on IZArc.exe and its child processes.
- Alert on new persistence artifacts created within five minutes of an IZArc archive open event.
- Log and review file writes made by processes that load unrar.dll outside expected extraction paths.
How to Mitigate CVE-2025-60835
Immediate Actions Required
- Do not open untrusted RAR archives with IZArc v4.6 until a vendor patch is applied.
- Validate archive contents using a hardened tool that enforces path canonicalization before extraction.
- Restrict user permissions so extraction accounts cannot write to sensitive system or startup locations.
Patch Information
No vendor patch is currently listed in the NVD advisory for CVE-2025-60835. Monitor the IZArc project page and the RARLab RAR file additions reference for updates to unrar.dll and the IZArc distribution.
Workarounds
- Replace IZArc v4.6 with an actively maintained archive tool that validates entry paths against the extraction root.
- Extract archives inside a sandbox or restricted directory such as an AppContainer or a low-privilege user profile.
- Use scripted pre-extraction inspection to reject archives whose entries contain .. or absolute path components.
# Configuration example: pre-extraction path validation with unrar list mode
unrar lb suspicious.rar | grep -E '(\.\.[\\/]|^[A-Za-z]:|^[\\/])' && echo "Unsafe entries detected - do not extract"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
