CVE-2025-60835

Deferred Deferred - Pending Action

Path Traversal in IZArc via unrar.dll

Publication date: 2026-07-22

Last updated on: 2026-07-24

Assigner: MITRE

Description

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-24

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-10

NVD

CVE-2025-60835

Affected Vendors & Products

Vendor	Product	Version / Range
izarc	unrar	4.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-35	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the unrar.dll component of IZArc version 4.6. Path traversal allows attackers to access files and directories outside the intended location, potentially leading to unauthorized file access or execution.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive files, execute arbitrary code, or gain control over the affected system by manipulating file paths. Users of IZArc v4.6 are at risk if they process untrusted archives.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using IZArc v4.6 may face compliance breaches if sensitive data is exposed due to exploitation.

Mitigation Strategies

Immediately uninstall or stop using IZArc v4.6 to prevent exploitation. Update to the latest version if a patch is available. Monitor network traffic for unusual file extraction patterns.

Hi! I’m here to help you understand CVE-2025-60835. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70