CVE-2025-52331

low-risk

Published 2025-11-12

Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Winrar

Affected Vendors

Rarlab

References (3)

Third Party Advisory https://gist.github.com/MarcinB44/2150484497c4b34aedf682c9091b14fa

Release Notes https://www.rarlab.com/rarnew.htm

Release Notes https://www.win-rar.com/whatsnew.html

/ 100

low-risk

Severity 23/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal