EUVD-2025-210497Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File parsed locally (AV:L), no system privileges needed (PR:N), but victim must extract the archive (UI:R); all three impact dimensions are high due to arbitrary file write.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
AnalysisAI
Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.
Technical ContextAI
IZArc is a Windows-based multi-format file archiver utility (version 4.6) that delegates RAR archive processing to an embedded unrar.dll library. CWE-35 (Path Traversal) identifies the root cause: the component fails to sanitize or reject path components within archive entries that contain directory traversal sequences (e.g., '../'). This is a variant of the well-documented 'Zip Slip' class of vulnerabilities, where archive parsers that do not canonicalize extraction paths prior to writing allow entries to escape the destination directory. The CPE data in NVD is listed as n/a, indicating the product is not yet formally registered; the affected component is specifically identified as unrar.dll within IZArc v4.6 per the researcher's advisory at github.com/OV-0-VO/Public-references.
RemediationAI
No vendor-released patch with an explicit fixed version has been identified at time of analysis. Users of IZArc v4.6 should check the vendor site at izarc.org for an updated release addressing this path traversal. As a compensating control, users can switch to an alternative archiver (such as 7-Zip or WinRAR) for extracting untrusted RAR files until a fix is available, eliminating the vulnerable code path entirely. If IZArc must remain in use, restrict extraction of RAR archives to trusted sources only, and always extract to isolated or sandboxed directories rather than directly to system paths; this limits the blast radius of a path traversal to the sandbox location. The researcher's advisory is available at github.com/OV-0-VO/Public-references/blob/main/CVE-2025-60835.md.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today