A new update is available for WinRAR. It is version 7.13 and this version fixes another vulnerability that can occur when traversing directories.
When extracting a file, earlier versions of WinRAR, Windows versions of RAR, UnRAR, the portable UnRAR source code, and UnRAR.dll can be tricked into using a path defined in a specially crafted archive instead of the user-specified path. The Unix versions of RAR, UnRAR, the portable UnRAR source code and library, and RAR for Android are not affected.
Fixes in WinRAR 7.13
- The "Import Settings from File" command in WinRAR failed to restore settings saved by WinRAR versions prior to 7.12.
- WinRAR set a larger than specified restore size for compression profiles created with WinRAR 5.21 and earlier.