Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2023-08-23

CVE-2023-38831

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

  1. First PoC
  2. 1001 days →Metasploit
  3. 149 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2023-08-24 · due 2023-09-14 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
99.8%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

61 known · links only

GitHub PoCs · by trust, then stars60

  1. b1tg/CVE-2023-38831-winrar-exploit ↗Trust ok 100

    CVE-2023-38831 winrar exploit generator

    ★ 783 · created 2023-08-25

  2. Garck3h/cve-2023-38831 ↗Trust ok 100

    一款用于生成winrar程序RCE（即cve-2023-38831）的POC的工具。

    ★ 126 · created 2023-08-27

  3. ignis-sec/CVE-2023-38831-RaRCE ↗Trust ok 100

    An easy to install and easy to run tool for generating exploit payloads for CVE-2023-38831, WinRAR RCE before versions 6.23

    ★ 113 · created 2023-08-27

  4. BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc ↗Trust ok 100

    lazy way to create CVE-2023-38831 winrar file for testing

    ★ 91 · created 2023-08-24

  5. HDCE-inc/CVE-2023-38831 ↗Trust ok 100

    CVE-2023-38831 PoC (Proof Of Concept)

    ★ 89 · created 2023-08-28

  6. knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831 ↗Trust ok 100

    Understanding WinRAR Code Execution Vulnerability (CVE-2023-38831)

    ★ 40 · created 2023-08-28

  7. Maalfer/CVE-2023-38831_ReverseShell_Winrar-RCE ↗Trust ok 100

    Pasos necesarios para obtener una reverse shell explotando la vulnerabilidad de winrar CVE-2023-38831 en versiones anteriores a 6.23.

    ★ 22 · created 2023-08-28

  8. xaitax/WinRAR-CVE-2023-38831 ↗Trust ok 100

    This module exploits a vulnerability in WinRAR (CVE-2023-38831). When a user opens a crafted RAR file and its embedded document, a script is executed, leading to code execution.

    ★ 17 · created 2023-09-03

  9. MorDavid/CVE-2023-38831-Winrar-Exploit-Generator-POC ↗Trust ok 100

    This is a POC for the CVE-2023-3883 exploit targeting WinRAR up to 6.22. Modified some existing internet-sourced POCs by introducing greater dynamism and incorporated additional try-except blocks within the code.

    ★ 13 · created 2023-08-30

  10. ahmed-fa7im/CVE-2023-38831-winrar-expoit-simple-Poc ↗Trust ok 100

    CVE-2023-38831 winrar exploit generator and get reverse shell

    ★ 11 · created 2023-08-28

  11. youmulijiang/evil-winrar ↗Trust ok 100

    evil-winrar,CVE-2023-38831漏洞利用和社会工程学攻击框架 (evil-winrar, CVE-2023-38831 Vulnerability Exploitation and Social Engineering Attack Framework)

    ★ 11 · created 2024-03-25

  12. Malwareman007/CVE-2023-38831 ↗Trust ok 100

    CVE-2023-38831 WinRaR Exploit Generator

    ★ 9 · created 2023-09-12

  13. UnHackerEnCapital/PDFernetRemotelo ↗Trust ok 100

    PoC - Prueba de Concepto de CVE-2024-4367 en conjunto al CVE-2023-38831 en un solo Script

    ★ 6 · created 2024-06-19

  14. z3r0sw0rd/CVE-2023-38831-PoC ↗Trust ok 100

    Proof-of-Concept for CVE-2023-38831 Zero-Day vulnerability in WinRAR

    ★ 6 · created 2023-08-30

  15. malvika-thakur/CVE-2023-38831 ↗Trust ok 100

    Proof-of-Concept (POC) of CVE-2023-38831 Zero-Day vulnerability in WinRAR

    ★ 4 · created 2023-09-21

  16. PascalAsch/CVE-2023-38831-KQL ↗Trust ok 100

    KQL Hunting for WinRAR CVE-2023-38831

    ★ 4 · created 2023-08-28

  17. xk-mt/WinRAR-Vulnerability-recurrence-tutorial ↗Trust ok 100

    WinRAR-6.22、CVE-2023-38831、CNNVD-202308-1943、DM-202307-003730、QVD-2023-19572漏洞复现

    ★ 4 · created 2023-11-15

  18. akhomlyuk/cve-2023-38831 ↗Trust ok 100

    CVE-2023-38831 WinRAR

    ★ 3 · created 2023-08-28

  19. ameerpornillos/CVE-2023-38831-WinRAR-Exploit ↗Trust ok 100

    Proof of concept (PoC) exploit for WinRAR vulnerability (CVE-2023-38831) vulnerability

    ★ 3 · created 2023-09-12

  20. kuyrathdaro/cve-2023-38831 ↗Trust ok 100

    CVE-2023-38831 (PoC) - WinRAR Exploit

    ★ 3 · created 2024-12-30

  21. Mich-ele/CVE-2023-38831-winrar ↗Trust ok 100

    CVE-2023-38831 winrar exploit builder

    ★ 3 · created 2023-09-01

  22. RonF98/CVE-2023-38831-POC ↗Trust ok 100

    CVE-2023-38831 is a Zero-day WinRAR vulnerability that lets attackers disguise malicious files in archives, tricking users into executing harmful content.

    ★ 3 · created 2026-03-08

  23. IR-HuntGuardians/CVE-2023-38831-HUNT ↗Trust ok 100

    ★ 2 · created 2023-08-27

  24. MaorBuskila/Windows-X64-RAT ↗Trust ok 100

    Remote Access Trojan (RAT) for Windows x64 using a combination of vulnerability CVE-2023-38831 (WinRAR < 6.23 vulnerability) and Shellcode exploitation technique.

    ★ 2 · created 2024-07-23

  25. r1yaz/winDED ↗Trust ok 100

    Exploit Development using python for CVE-2023-38831 (POC)

    ★ 2 · created 2023-12-26

  26. Ben1B3astt/CVE-2023-38831_ReverseShell_Winrar ↗Trust ok 100

    ★ 1 · created 2023-08-30

  27. olowostandard1/CVE-2023-38831-WinRAR-Vulnerability-Analysis ↗Trust ok 100

    This project is a cybersecurity research and analysis project focused on CVE-2023-38831, a critical WinRAR vulnerability that allows attackers to execute malicious code through specially crafted archive files. The project was conducted in a controlled lab environment for educational and defensive security purposes only.

    ★ 1 · created 2026-05-11

  28. ruycr4ft/CVE-2023-38831 ↗Trust ok 100

    ★ 1 · created 2023-10-12

  29. s4m98/winrar-cve-2023-38831-poc-gen ↗Trust ok 100

    WinRAR cve-2023-38831-poc-generator

    ★ 1 · created 2023-11-07

  30. SpamixOfficial/CVE-2023-38831 ↗Trust ok 100

    CVE-2023-38831 Proof-of-concept code

    ★ 1 · created 2023-12-12

  31. technicalcorp0/CVE-2023-38831-Exploit ↗Trust ok 100

    This project contains a Python script that exploits **CVE-2023-38831**, a vulnerability in **WinRAR** versions prior to 6.23. The exploit generates a **malicious RAR archive** that triggers the execution of arbitrary code when the victim opens a benign-looking file within the archive (such as a PDF).

    ★ 1 · created 2024-09-27

  32. thegr1ffyn/CVE-2023-38831 ↗Trust ok 100

    Proof of Concept (POC) for CVE-2023-38831 WinRAR

    ★ 1 · created 2023-08-29

  33. yezzfusl/cve_2023_38831_scanner ↗Trust ok 100

    This Python application scans for the CVE-2023-38831 vulnerability in WinRAR.

    ★ 1 · created 2024-08-06

  34. anelya0333/Exploiting-CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2025-11-20

  35. asepsaepdin/CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2023-09-03

  36. cristhiansm0/TXDXCristhian_2023-CVE-38831 ↗Trust ok 100

    CVE-2023-38831 WinRAR lab: detection with Sysmon/Wazuh, reverse engineering with Ghidra, patch analysis, and remediation.

    ★ 0 · created 2026-08-05

  37. Dnyaneshwari-123/DFIR-Capstone-Investigations ↗Trust ok 100

    Three DFIR investigations: memory forensics (Volatility), disk/malware analysis (Silent Breach), and attack-chain reconstruction (CVE-2023-38831). Reports, timelines, IOCs and MITRE ATT&CK mapping.

    ★ 0 · created 2026-09-29

  38. Fa1c0n35/CVE-2023-38831-winrar-exploit ↗Trust ok 100

    ★ 0 · created 2023-09-03

  39. FirFirdaus/CVE-2023-38831 ↗Trust ok 100

    A POC demo on CVE-2023-38831

    ★ 0 · created 2024-08-30

  40. GOTonyGO/CVE-2023-38831-winrar ↗Trust ok 100

    Quick exploit builder for CVE-2023-38831, a vulnerability that affects WinRAR versions before 6.23.

    ★ 0 · created 2023-09-07

  41. h3xecute/SideCopy-Exploits-CVE-2023-38831 ↗Trust ok 100

    SideCopy APT Group exploits CVE-2023-38831

    ★ 0 · created 2023-11-01

  42. Hirusha-N/CVE-2021-34527-CVE-2023-38831-and-CVE-2023-32784 ↗Trust ok 100

    ★ 0 · created 2024-06-25

  43. idkwastaken/CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2024-10-15

  44. imbyter/imbyter-WinRAR_CVE-2023-38831 ↗Trust ok 100

    WinRAR漏洞测试复现。详参：https://flowus.cn/share/a3b35db0-ab5e-4abc-b8d3-5ff284e82e7b

    ★ 0 · created 2024-06-17

  45. kehrijksen/CVE-2023-38831 ↗Trust ok 100

    CVE-2023-38831 is an RCE in WinRAR (<6.23)

    ★ 0 · created 2023-10-24

  46. khanhtranngoccva/cve-2023-38831-poc ↗Trust ok 100

    ★ 0 · created 2024-07-16

  47. KrioSocial/defender-bypass-winrar-cve-2023-38831 ↗Trust ok 100

    The purpose of this lab is to empirically demonstrate that relying solely on the free, built-in Microsoft Defender Antivirus is insufficient for small businesses. While free Defender provides baseline endpoint protection, it lacks the operational capabilities, patching, and 24/7 monitoring required to stop modern, multi-stage attacks.

    ★ 0 · created 2026-09-30

  48. lightningspeed221/Winrar-Exploit-CVE-2023-38831 ↗Trust ok 100

    Winrar Exploit CVE-2023-38831

    ★ 0 · created 2026-04-30

  49. mishra0230/CVE-2023-38831 ↗Trust ok 100

    CVE-2023-38831 - WinRAR

    ★ 0 · created 2026-01-09

  50. ML-K-eng/CVE-2023-38831-Exploit-and-Detection ↗Trust ok 100

    This repository has both an attack detection tool and a Proof-of-Concept (PoC) Python script for the WinRAR CVE-2023-38831 vulnerability.

    ★ 0 · created 2023-08-29

  51. MyStuffYT/CVE-2023-38831-POC ↗Trust ok 100

    Proof-of-concept of CVE-2023-38831

    ★ 0 · created 2023-12-04

  52. ngothienan/CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2023-09-17

  53. Nielk74/CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2023-10-21

  54. ra3edAJ/LAB-DFIR-cve-2023-38831 ↗Trust ok 100

    d

    ★ 0 · created 2024-09-26

  55. RomainBayle08/CVE-2023-38831 ↗Trust ok 100

    ★ 0 · created 2024-04-06

  56. sh770/CVE-2023-38831 ↗Trust ok 100

    winrar exploit 6.22 <=

    ★ 0 · created 2023-08-30

  57. solomon12354/VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC ↗Trust ok 100

    This is my malware

    ★ 0 · created 2024-04-01

  58. sudo-py-dev/CVE-2023-38831 ↗Trust ok 100

    winrar exploit 6.22 <=

    ★ 0 · created 2023-08-30

  59. Tolu12wani/Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution ↗Trust ok 100

    This project demonstrates a simulated exploitation of the WinRAR vulnerability CVE-2023-38831 to execute a reverse shell. The purpose of this task was to showcase how attackers can weaponize compressed archive files to gain remote access to a target machine.

    ★ 0 · created 2025-08-03

  60. VictoriousKnight/CVE-2023-38831_Exploit ↗Trust ok 100

    ★ 0 · created 2024-12-03

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. WinRAR CVE-2023-38831 Exploit ↗

    This module exploits a vulnerability in WinRAR (CVE-2023-38831). When a user opens a crafted RAR file and its embedded document, the decoy document is executed, leading to code execution.

    ruby · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.