{
  "cveId": "CVE-2025-52331",
  "url": "https://patchblox.com/security/cve/CVE-2025-52331",
  "summary": "CVE-2025-52331 is fixed in WinRAR on 1 platform by WinRAR 7.12.0 (version 7.12.0), released June 23, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "WinRAR: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
  "description": "Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the \u0022generate report\u0022 functionality and open the report.",
  "published": "2025-11-12T17:15:37Z",
  "severity": "",
  "cvss": 6.1,
  "cwe": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
  "epss": 0.0033,
  "epssPercentile": 0.26345,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2025-52331",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "WinRAR",
      "fixedVersion": "7.12.0",
      "fix": "WinRAR 7.12.0",
      "url": "https://patchblox.com/security/fix/windows-app/rarlab.winrar-7.12.0",
      "released": "2025-06-23T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}