New Update WinRAR - Updates Thread

System utilities
37 Replies 11,089 Views
WinRAR 7.11 (stable version)
WinRAR - What's new in the latest version

Version 7.11

1. If "Add to archive..." Explorer context menu command is applied to
multiple archives in the disk root, for example, d:\arc1.rar
and d:\arc2.rar, WinRAR will propose arc1_rar.rar default name
for a new archive. Previous version proposed arc1.rar, updating one
of selected archives instead of creating a new one.

2. Bugs fixed:

a) WinRAR 7.10 failed to update solid archives containing a folder
record placed before a file record. It issued the checksum error
message and aborted processing.

As a result of this fix, this version preserves the original position
of such folders after updating and doesn't move them to the end
of archive as WinRAR 7.10 did;

b) when extracting a file from CAB archive over an existing file,
existing files were overwritten, but not truncated.
So if existing file was larger than extracted, existing file data
had been left at the end of the extracted file;

c) if SFX module from "Advanced SFX options" dialog was stored
in the compression profile, it was applied as is, even if archive
format was changed after selecting the profile. It could result
in SFX module mismatching the archive format;

d) choosing a value in bytes from drop down list associated
with archive dialog "Split to volumes, size" field didn't set
units to bytes automatically;

e) if SFX "TextDone" command was used together with "Silent"
and "TempMode" commands, the completion message was sometimes
displayed behind other opened windows;

f) if symlink pointing at an executable was started from WinRAR shell,
the executable Mark of the Web data was ignored. We are thankful
to Shimamine Taihei of Mitsui Bussan Secure Directions, Inc
for reporting this issue.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.12 beta 1
Version 7.12 beta 1

1. When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to whs3-detonator working with Trend Micro Zero Day
Initiative for letting us know about this security issue.


2. Previously "Generate report" command included archived file names
into HTML report as is, allowing to inject potentially unsafe HTML tags
into the report. To prevent such injection the current version replaces
< and > file name characters in HTML report with < and > strings.

We are thankful to Marcin Bobryk (github.com/MarcinB44) for bringing
this security issue to our attention.


3. If "Test archived files" and "recovery volumes" archiving options
are used together, recovery volumes are also tested. Previous versions
completed the test before creating recovery volumes, so they hadn't
been verified.

4. Nanosecond file time precision is preserved for Unix file records
when modifying RAR archive in Windows. Previously it was converted
to Windows 100 nanosecond precision.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.12 (stable)
Version 7.12

1. When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to whs3-detonator working with Trend Micro Zero Day
Initiative for letting us know about this security issue.

2. Previously "Generate report" command included archived file names
into HTML report as is, allowing to inject potentially unsafe HTML tags
into the report. To prevent such injection the current version replaces
< and > file name characters in HTML report with < and > strings.

We are thankful to Marcin Bobryk (github.com/MarcinB44) for bringing
this security issue to our attention.

3. If "Test archived files" and "recovery volumes" archiving options
are used together, recovery volumes are also tested. Previous versions
completed the test before creating recovery volumes, so they hadn't
been verified.

4. Nanosecond file time precision is preserved for Unix file records
when modifying RAR archive in Windows. Previously it was converted
to Windows 100 nanosecond precision.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 

WinRAR 7.13 Beta 1​

Version 7.13 beta 1

1. Another directory traversal vulnerability, differing from that
in WinRAR 7.12, has been fixed.

When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to Anton Cherepanov, Peter Kosinar, and Peter Strycek
from ESET for letting us know about this security issue.

2. Bugs fixed:

a) WinRAR 7.12 "Import settings from file" command failed to restore
settings, saved by WinRAR versions preceding 7.12;

b) WinRAR 7.12 set a larger than specified recovery size for compression
profiles, created by WinRAR 5.21 and older.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.13 (stable release)
Version 7.13

1. Another directory traversal vulnerability, differing from that
in WinRAR 7.12, has been fixed.

When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to Anton Cherepanov, Peter Kosinar, and Peter Strycek
from ESET for letting us know about this security issue.

2. Bugs fixed:

a) WinRAR 7.12 "Import settings from file" command failed to restore
settings, saved by WinRAR versions preceding 7.12;

b) WinRAR 7.12 set a larger than specified recovery size for compression
profiles, created by WinRAR 5.21 and older.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
Update your WinRAR because hackers are using this flaw to sneak malware onto your PC
Last week, WinRAR 7.13 dropped with a fix for a directory traversal vulnerability tracked as CVE-2025-8088. We now have more details on the exploit, thanks to work by researchers from ESET who discovered that attackers were actively abusing the flaw.

The vulnerability exists within UNRAR.dll, a core library handling archive extraction. Attackers craft a malicious archive that can then trick the software into writing a file to a location they choose, instead of the directory a user selects.
As Bleeping Computer notes, WinRAR has no built-in automatic update mechanism, so anyone using the software needs to manually visit the official site and install version 7.13 to be protected. The WinRAR devs claim that Unix versions of RAR and UnRAR, along with RAR for Android, are not affected.
 
WinRAR 7.20 Beta 1
Version 7.20 beta 1

1. Performance improvements when deleting files in solid RAR archives:

a) if there are no non-zero files after deleted files, archive
recompressing isn't performed;

b) part of archive before deleted files is copied as is, without
repacking. Its contents is unpacked to memory if necessary,
but not recompressed;

c) semi-solid archive processing involves only solid blocks containing
deleted files. Unaffected solid blocks are copied as is.

2. "Generate archive name by mask" archiving option and -ag command line
switch:

a) new 'K' format character defines the current day of week
name as a text string;

b) new 'O' format character defines the current month name as a text
string regardless of format character number. Unlike "MMM" mask,
it allows to use shorter or longer than 3 character names,
such as -agOO;

c) excessive format characters exceeding the available field width
are now ignored instead of appending to archive name.
So it is possible to use full month or week day names by providing
format characters in the amount equal or exceeding the longest name,
such as -agKKKKKKKKKK for day of week names.

3. Command line -s switch:

a) switch -s accepts the optional parameter preceded by '=' character.

Switches -s, -se, -sv, -sv-, -s- are replaced by -s=f, -s=e,
-s=v, -s=d, -s=-. Previous versions of these switches are still
supported in the current version, but can be removed in the future.

It is allowed to combine multiple modifiers in the same switch,
such as -s=e100f.

b) new switch -s=r resets the solid statistics before adding new files
to existing archive.

4. Switch -tk now accepts the optional date parameter in YYYYMMDDHHMMSS
format. If used without parameter when modifying an archive,
it preserves the original archive time. If optional parameter
is present, it is assigned to archive modification time.

It is allowed to insert separators like '-' or ':' to the date string
and omit trailing fields. For example, switch -tk2025-06-01 is correct.

5. "Specified time" is added to "Set archive time to" options on "Time"
page of archiving dialog. It allows to assign the manually entered time
to newly created or modified archives.

6. UTF-8 output format and byte order mask options are added to
"Generate report" command.

7. "Cloud files" option is added to "Where to check for SFX archives"
group in "Settings/Integration/Context menu items..." dialog.

If this option is off, WinRAR shell extension will not attempt
to detect if archive is self-extracting, when right clicking
an executable cloud file not available locally. This detection
involves data read and can be slow for such files.

This option relies on file attributes returned by a cloud storage
provider and can be ignored if required attribute isn't supported
by specific cloud service.

8. "Copy to clipboard" button at the bottom of "Search results" dialog
places current results of "Find files" command to clipboard.

9. It takes less time to open a large archive with a lot of files
and folders in WinRAR file list. This is most noticeable for ZIP
archives containing millions of files.

10. Improved extraction speed of TAR and TAR based archives,
such as .tar.gz or tar.xz. It is most visible for hard disk drives
with slower seek time and large archives containing a lot of files.

11. SFX module sets sfxnamenoext environment variable, containing
SFX archive name without path and extension. It allows to append
the archive name to user defined destination path like:

Path=c:\Util\%sfxnamenoext%"

12. "minsize" parameter, defining the minimum file reference size
in -oi[0-4][:] switch, now can include an optional trailing
unit size character. So -oi:1m is the equivalent of -oi:1048576.

13. Switch -x recognizes exclude paths with both Windows and Unix style
path separators, so -xfolder\file and -xfolder/file do the same.
Previously only -xfolder\file excluded the file.

14. Bugs fixed:

a) "Files to exclude" field of archiving dialog was ignored for all
but first ZIP archives if "Put each file to separate archive"
option was turned on;

b) when processing "Convert archives" command, "Use for all archives"
option in the password prompt was available only for encrypted
archives with file name encryption and couldn't be enabled
when converting archives without encrypted file names.
Source: WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.20 Beta 3
Version 7.20 beta 3

1. Original and packed file size column widths in "l" and "v" commands
are increased by 1 symbol, so 10 digit file sizes are also displayed
aligned by these commands.

2. If "Reuse existing window" option is enabled when opening an archive,
but another WinRAR copy is busy with archive processing, the archive
is opened by current copy. Previously neither of copies opened it.

3. Bugs fixed:

a) previous beta failed to open archives in ZIP format with extra fields
shorter than 4 bytes, such as some APK files;

b) "Ask" option in WinRAR "Settings/Viewer/Viewer type" didn't display
the viewer type prompt for PNG files and several other image formats;

c) -ag switch 'k' modifier used English week day names even
in localized versions.
WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.20 (stable release)

Version 7.20

1. Performance improvements when deleting files in solid RAR archives:

a) if there are no non-zero files after deleted files, archive
recompressing isn't performed;

b) part of archive before deleted files is copied as is, without
repacking. Its contents is unpacked to memory if necessary,
but not recompressed;

c) semi-solid archive processing involves only solid blocks containing
deleted files. Unaffected solid blocks are copied as is.

2. "Generate archive name by mask" archiving option and -ag command line
switch:

a) new 'K' format character defines the current day of week
name as a text string;

b) new 'O' format character defines the current month name as a text
string regardless of format character number. Unlike "MMM" mask,
it allows to use shorter or longer than 3 character names,
such as -agOO;

c) excessive format characters exceeding the available field width
are now ignored instead of appending to archive name.
So it is possible to use full month or week day names by providing
format characters in the amount equal or exceeding the longest name,
such as -agKKKKKKKKKK for day of week names.

3. Command line -s switch:

a) switch -s accepts the optional parameter preceded by '=' character.

Switches -s, -se, -sv, -sv-, -s- are replaced by -s=f, -s=e,
-s=v, -s=d, -s=-. Previous versions of these switches are still
supported in the current version, but can be removed in the future.

It is allowed to combine multiple modifiers in the same switch,
such as -s=e100f.

b) new switch -s=r resets the solid statistics before adding new files
to existing archive.

4. Switch -tk now accepts the optional date parameter in YYYYMMDDHHMMSS
format. If used without parameter when modifying an archive,
it preserves the original archive time. If optional parameter
is present, it is assigned to archive modification time.

It is allowed to insert separators like '-' or ':' to the date string
and omit trailing fields. For example, switch -tk2025-06-01 is correct.

5. "Specified time" is added to "Set archive time to" options on "Time"
page of archiving dialog. It allows to assign the manually entered time
to newly created or modified archives.

6. UTF-8 output format and byte order mark options are added to
"Generate report" command.

7. "Cloud files" option is added to "Where to check for SFX archives"
group in "Settings/Integration/Context menu items..." dialog.

If this option is off, WinRAR shell extension will not attempt
to detect if archive is self-extracting, when right clicking
an executable cloud file not available locally. This detection
involves data read and can be slow for such files.

This option relies on file attributes returned by a cloud storage
provider and can be ignored if required attribute isn't supported
by specific cloud service.

8. "Copy to clipboard" button at the bottom of "Search results" dialog
places current results of "Find files" command to clipboard.

9. It takes less time to open a large archive with a lot of files
and folders in WinRAR file list. This is most noticeable for ZIP
archives containing millions of files.

10. Improved extraction speed of TAR and TAR based archives,
such as .tar.gz or tar.xz. It is most visible for hard disk drives
with slower seek time and large archives containing a lot of files.

11. SFX module sets sfxnamenoext environment variable, containing
SFX archive name without path and extension. It allows to append
the archive name to user defined destination path like:

Path=c:\Util\%sfxnamenoext%"

12. "minsize" parameter, defining the minimum file reference size
in -oi[0-4][:] switch, now can include an optional trailing
unit size character. So -oi:1m is the equivalent of -oi:1048576.

13. Switch -x recognizes exclude paths with both Windows and Unix style
path separators, so -xfolder\file and -xfolder/file do the same.
Previously only -xfolder\file excluded the file.

14. Bugs fixed:

a) "Files to exclude" field of archiving dialog was ignored for all
but first ZIP archives if "Put each file to separate archive"
option was turned on;

b) when processing "Convert archives" command, "Use for all archives"
option in the password prompt was available only for encrypted
archives with file name encryption and couldn't be enabled
when converting archives without encrypted file names.

 
Last edited by a moderator:
WinRAR 7.21 Beta 1
Version 7.21 beta 1

1. WinRAR properly recognizes archives with a wrong file extension,
containing an archive in another format stored without compression.

For example, if host.rar, storing nested.zip inside, was renamed to
host.zip, previous versions could display nested.zip contents
when opening such host.zip. This version displays host.zip contents.

2. Similarly to Windows Explorer, the first click on size and time columns
in WinRAR file list sets the reverse sort mode with largest and latest
files at the top.

3. Switch -s=e performs the case insensitive file extension comparison
in Windows. Unlike previous versions, solid statistics isn't reset
anymore for file extensions differing only by case.

4. If self-extracting archive attempts to extract files to a folder
requring administrator rights and elevation prompt is cancelled by user,
the archive quits silently instead of issuing the folder access error.

5. Bugs fixed:

a) WinRAR 7.20 couldn't unpack ZIP archives containing file comment
fields;

b) switch -tl didn't set the latest time when used with RAR 7.20
"ch" command;

c) extraction command didn't automatically replace device names
like "aux", when unpacking archives containing such reserved names;

d) if folder shortcut was double clicked in "Save WinRAR settings as"
dialog when exporting WinRAR settings, folder shortcut itself was
overwritten with settings data instead of opening a target folder.
WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.21 (stable release)
Version 7.21

1. WinRAR properly recognizes archives with a wrong file extension,
containing an archive in another format stored without compression.

For example, if host.rar, storing nested.zip inside, was renamed to
host.zip, WinRAR 7.20 could display nested.zip contents when opening
such host.zip. This version displays host.zip contents.

2. Similarly to Windows Explorer, the first click on size and time columns
in WinRAR file list sets the reverse sort mode with largest and latest
files at the top.

3. Switch -s=e performs the case insensitive file extension comparison
in Windows. Unlike previous versions, solid statistics isn't reset
anymore for file extensions differing only by case.

4. If self-extracting archive attempts to extract files to a folder
requring administrator rights and elevation prompt is cancelled by user,
the archive quits silently instead of issuing the folder access error.

5. Bugs fixed:

a) WinRAR 7.20 could produce a broken archive when deleting files from
solid archives in old RAR4 format. As a result of this fix, deleting
files in solid RAR4 archives now involves the full archive repacking,
similar to WinRAR versions preceding 7.20. It doesn't affect archives
in the modern RAR5 format;

b) with a rare combination of source data type and compression
parameters, WinRAR 7.x could crash when compressing source data.
Such crash was more likely when processing large amount of poorly
compressible data;

c) WinRAR 7.20 couldn't unpack ZIP archives containing file comment
fields;

d) switch -tl didn't set the latest time when used with RAR 7.20
"ch" command;

e) extraction command didn't automatically replace device names
like "aux", when unpacking archives containing such reserved names;

f) if folder shortcut was double clicked in "Save WinRAR settings as"
dialog when exporting WinRAR settings, folder shortcut itself was
overwritten with settings data instead of opening a target folder.

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.23 (stable release)
Version 7.23

1. Heap overflow vulnerability is fixed in RAR5 recovery volume
data reconstruction code. It affects WinRAR, RAR and UnRAR.
UnRAR.dll library doesn't include recovery volume processing,
so it is not affected.

We are thankful to Arjun Basnet from Securin Labs for letting us know
about this security issue.

2. Symbolic link pointing outside of destination folder could be created
even without -ola switch, when extracting a specially crafted
RAR archive by WinRAR, RAR, UnRAR or UnRAR.dll library.

Further check in extraction code prevents placing files to such folder
even in case of multiple extraction commands, excluding the possibility
of path traversal attack for WinRAR, RAR or UnRAR based extraction.
It limits the potential threat to a case where another tool uses this
symbolic link to store files.

We are thankful to scofaild23-bnomran for letting us know about this
security issue.

3. 7zxa.dll 7z extraction library is updated to version 26.02 to include
bug and vulnerability fixes by the library developer.

4. Switch -iver prints RAR version even if -idc is specified
in the command line, configuration file or RARINISWITCHES environment
variable. Previously -idc blocked -iver action.

Also a new line character is added to -iver output.

Download: WinRAR and RAR archiver downloads
 
WinRAR 7.30 Beta 1
Version 7.30 beta 1

1. Added decompression support for sparse files in TAR archives
in both GNU TAR and PAX sparse formats. WinRAR attempts to create
Windows sparse files when unpacking them and resorts to filling
sparse holes with 0 if it is not possible.

2. New "Tab size" option in WinRAR "Settings/Viewer" defines the internal
viewer tab size.

3. NTFS alternate data streams:

a) command line RAR displays stream names when saving them to archive,
also as when extracting or testing archived streams.
Previously they were processed silently.

Stream positions in solid archiving display output can mismatch
their actual archive positions, because of internal buffering
applied to groups of smaller files;

b) command line -kb switch and GUI WinRAR "Keep broken files" option
are respected also for streams. If stream data is damaged,
but still can be unpacked partially, these options preserve
unpacked data on disk. Previous versions deleted broken streams
regardless of these options;

c) error message is displayed and exit code 6 is set if stream
can't be opened when archiving. Previously such open errors
had been ignored silently.

4. Commands 'l' and 'v' now recognize 'a' modifier, even if 't' modifier
isn't present. It is allowed to use 'va', 'la' or 'vba' to include
information about service archive blocks in the single line mode.
For example, "rar va arc.rar" can be used to view included
NTFS alternate data streams in more concise single line listing.

5. New command line -da switch can be used with 'x' and 'e' commands
to silently delete an unpacked archive after successful extraction.
For RAR volumes it deletes the entire volume set including
REV recovery volumes, if available. If used with -dr switch,
it places deleted files to Recycle Bin instead of removing them
permanently.

6. Exit code 14 is added for file delete errors when using command line
switches -da and -df.

7. When creating an archive, the new command line -ed1 switch excludes
only those folders, which do not contain any files. Unlike -ed switch,
information about folders with files is saved in archive,
so timestamps and other properties of such folders are preserved
and restored when extracting.

8. If empty folder with the same name as unpacking file exists
and overwrite has been confirmed by a user, such folder is replaced
by the file. Previous versions failed with "Access is denied" error
in this case.

9. Proper file and folder icons are displayed in the overwrite prompt
when extracting a folder over existing file or file over existing folder.
Previous versions displayed the existing item icon for both source
and destination.

10. WinRAR issues an error when unpacking a truncated .tar.xz archive.
Previous versions did it for truncated .xz archives, but not for .tar.xz.

11. Unicode paths not mappable to current ANSI code page are now allowed
for CAB volumes. Previous versions refused to unpack multivolume
CAB archives if their parent folder name couldn't be represented
in current ANSI encoding.

12. WinRAR tree panel properly displays the current folder even if path
depth exceeds 260 characters. Previous version stopped tracking
the current folder in tree panel, when exceeding this threshold.

13. Same archive is produced for same data and options even if recovery
record is included into archive. Previously, if multiple copies
of archive with recovery record had been created for same data
and options, all such copies always were different.

14. Bugs fixed:

a) RAR4 recovery volumes based data recovery was failed with
seek error if one of REV files was less than 7 bytes. It happened
even if other files were valid and allowed successful recovery.
WinRAR archiver, a powerful tool to process RAR and ZIP files

Download: WinRAR and RAR archiver downloads
 

Recently browsing

Members who viewed this thread in the last 5 minutes

Back
Top