What is the CVSS score of CVE-2025-60835?

CVE-2025-60835 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

IZArc CVE-2025-60835

EUVD-2025-210497 HIGH

Path Traversal: '.../...//' (CWE-35)

2026-07-22 mitre

Path Traversal N A

7.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File parsed locally (AV:L), no system privileges needed (PR:N), but victim must extract the archive (UI:R); all three impact dimensions are high due to arbitrary file write.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 22:36 vuln.today

Analysis Generated

Jul 24, 2026 - 22:36 vuln.today

CVSS changed

Jul 24, 2026 - 20:22 NVD

7.8 (HIGH)

CVE Published

Jul 22, 2026 - 00:00 cve.org

HIGH 7.8

CVE Published

Jul 22, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.

AnalysisAI

Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.

Technical ContextAI

IZArc is a Windows-based multi-format file archiver utility (version 4.6) that delegates RAR archive processing to an embedded unrar.dll library. CWE-35 (Path Traversal) identifies the root cause: the component fails to sanitize or reject path components within archive entries that contain directory traversal sequences (e.g., '../'). This is a variant of the well-documented 'Zip Slip' class of vulnerabilities, where archive parsers that do not canonicalize extraction paths prior to writing allow entries to escape the destination directory. The CPE data in NVD is listed as n/a, indicating the product is not yet formally registered; the affected component is specifically identified as unrar.dll within IZArc v4.6 per the researcher's advisory at github.com/OV-0-VO/Public-references.

RemediationAI

No vendor-released patch with an explicit fixed version has been identified at time of analysis. Users of IZArc v4.6 should check the vendor site at izarc.org for an updated release addressing this path traversal. As a compensating control, users can switch to an alternative archiver (such as 7-Zip or WinRAR) for extracting untrusted RAR files until a fix is available, eliminating the vulnerable code path entirely. If IZArc must remain in use, restrict extraction of RAR archives to trusted sources only, and always extract to isolated or sandboxed directories rather than directly to system paths; this limits the blast radius of a path traversal to the sandbox location. The researcher's advisory is available at github.com/OV-0-VO/Public-references/blob/main/CVE-2025-60835.md.