Arbitrary file upload in Rarlab Winrar
CVE-2014-125119
A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
EPSS exploit prediction
EPSS: 0.017 (76.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.017 · change: +0.002
Affected products
- Rarlab Winrar — versions 3.80, 4.11
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.rarlab.com/vuln_zip_spoofing_4.20.html (vendor-advisory)
- an7isec.blogspot.com/2014/03/winrar-file-extension-spoofing-0day.html (technical-description, exploit)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
- web.archive.org/web/20141111142204/https://www.intelcrawler.com/report_2603.pdf (technical-description)
- web.archive.org/web/20140625054244/http://intelcrawler.com/news-15 (technical-description, media-coverage)
- www.vulncheck.com/advisories/winrar-filename-spoofing-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2014-125119?
- CVE-2014-125119 is a vulnerability in Rarlab Winrar, classified under Improper Input Validation. Published 2025-07-25.
- Is CVE-2014-125119 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.