CVE-2025-14111: 
WinRAR vulnerability analysis and mitigation

CVE-2025-14111 is a path traversal vulnerability (CWE-22) in the Rarlab RAR App for Android (com.rarlab.rar) affecting versions up to and including 7.11 Build 127. The flaw allows remote attackers to read and write arbitrary files within the app's internal storage by manipulating file paths during the file import process. It was published on December 5, 2025, and a fix was released in RAR for Android 7.20 Build 128/129. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), though CVSS v4.0 rates it 1.3 (Low) due to required user interaction and passive exploitation conditions. WinRAR and Unix RAR versions are explicitly not affected (Red Hat CVE, Secsys-FDU PoC).

The vulnerability stems from insufficient input validation during the file import process in RAR for Android's MainActivity component (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). An attacker-controlled malicious Android app can send an Intent with ACTION_SEND to com.rarlab.rar.MainActivity, supplying a crafted content URI whose _display_name query parameter contains path traversal sequences (e.g., ../../../../../data/data/com.rarlab.rar/lulu). This allows the attacker to control both the filename and content of files written to, or read from, the RAR app's internal storage. A public proof-of-concept demonstrating both arbitrary file write and arbitrary file read has been disclosed on GitHub (Secsys-FDU PoC).

Successful exploitation allows an attacker to overwrite or read arbitrary files within the RAR app's internal storage (/data/data/com.rarlab.rar/), which can lead to arbitrary code execution, exposure of sensitive information (e.g., app preferences and credentials stored in shared preferences), and denial of service. The ability to write arbitrary files to internal storage could enable an attacker to replace configuration or executable components, potentially escalating to full app compromise. Sensitive data such as com.rarlab.rar_preferences.xml can be exfiltrated to attacker-accessible locations like external storage (Secsys-FDU PoC).

1. Develop a malicious Android app: Create an Android application that registers a custom ContentProvider with an authority such as media.evil.contentprovider. The provider's openFile() method returns a file with attacker-controlled content, and the query() method returns a cursor with a _display_name column containing a path traversal string (e.g., ../../../../../../../../../../../../../data/data/com.rarlab.rar/lulu).
2. Install the malicious app: Install the attacker-controlled app on the target Android device alongside the vulnerable RAR app (version ≤ 7.11 Build 127).
3. Trigger the file write: From the malicious app, send an Intent with ACTION_SEND targeting com.rarlab.rar.MainActivity, setting EXTRA_STREAM to a URI like content://media.evil.contentprovider/?_display_name=../../../../../../../../../../../../../data/data/com.rarlab.rar/lulu and MIME type */*.
4. Trigger the file read: To exfiltrate internal files, send a similar Intent using the RAR app's own file provider URI, e.g., content://com.rarlab.rar.provider/files/data/data/com.rarlab.rar/shared_prefs/com.rarlab.rar_preferences.xml?displayName=../../../../../../../../../../../../../sdcard/Documents/lulu_dump_rar_file, causing the RAR app to copy the sensitive file to an attacker-readable location.
5. Achieve objective: The attacker can now read sensitive app data (e.g., credentials, preferences) from external storage, or overwrite internal files to achieve code execution or denial of service (Secsys-FDU PoC).

• File System: Unexpected files appearing in /data/data/com.rarlab.rar/ with unusual names or content; sensitive files (e.g., com.rarlab.rar_preferences.xml) copied to world-readable locations such as /sdcard/Documents/.
• Android Logs (logcat): Intents with ACTION_SEND directed at com.rarlab.rar.MainActivity from unexpected or unknown source packages; content URI queries containing _display_name parameters with ../ path traversal sequences.
• Process/App Behavior: RAR app accessing or writing files outside its expected working directories; unexpected file I/O activity in the RAR app's internal storage directory as observed via Android audit logs or security monitoring tools.
• Network: Unexpected outbound data transfers from the device following RAR app activity, potentially indicating exfiltration of dumped files (Secsys-FDU PoC).

Users should immediately upgrade RAR for Android to version 7.20 Build 128 or later (the researchers note the fix is present in Build 129 as well), available via Google Play. If immediate patching is not possible, consider disabling or uninstalling the RAR app until the update can be applied, and avoid installing untrusted third-party apps on the same device. No configuration-based workaround is available; upgrading is the only definitive remediation. WinRAR and Unix RAR users are not affected and require no action (Red Hat CVE, Secsys-FDU PoC).

The vendor (RARLAB) responded professionally to the disclosure, confirming the vulnerability affects only RAR for Android and not WinRAR or Unix RAR, and noted the fix was included in the RAR for Android 7.20 Build 128 changelog. RARLAB requested that disclosures emphasize the Android-only scope to avoid user confusion. The vulnerability was reported by researchers from Secsys-FDU (Fudan University), who published a detailed PoC on GitHub. Coverage has been limited to vulnerability tracking platforms and national CERTs (e.g., INCIBE-CERT, CCN-CERT) with no significant broader media attention (Red Hat CVE, Secsys-FDU PoC).