WinRAR Filename Spoofing Exploit

The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header. This allows to spoof file names when opening ZIP files

and can be abused to execute arbitrary code.