CVE-2025-8088
RARLAB WinRAR Path Traversal Vulnerability
Description
CVE-2025-8088 is a high-severity path traversal vulnerability in RARLAB WinRAR, the widely used file archiving utility for Windows. The flaw allows attackers to craft malicious archive files that, when processed by WinRAR, execute arbitrary code on the victim's system. With a CVSS v3.1 score of 8.8, this zero-day vulnerability was actively exploited in the wild before a patch was available and was discovered by ESET researchers. CISA has added CVE-2025-8088 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 2, 2025, and the EPSS score of 3.83% at the 87th percentile confirms significant exploitation activity targeting WinRAR users.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| rarlab | winrar | < 7.13 |
| dtsearch | dtsearch | < 2023.01 |
References
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5(Release Notes)
- https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/(Press/Media Coverage)
- https://support.dtsearch.com/faq/dts0245.htm(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088(US Government Resource)
- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088(Press/Media Coverage)
Weakness Type
CWE-35: Path Traversal
CVE-2025-8088 is classified under CWE-35 (Path Traversal), a weakness where software uses external input to construct a file path without properly neutralizing directory traversal sequences. In WinRAR, a crafted archive can contain entries with manipulated paths that cause files to be extracted outside the intended directory, enabling the attacker to place executable files in locations where they will be automatically run by the operating system.
Learn more: CWE-35 — Path Traversal
Impact Analysis
CVE-2025-8088 has far-reaching impact due to WinRAR's massive global user base. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N) but does require user interaction (UI:R) in the form of opening a malicious archive file. Confidentiality (High): once arbitrary code executes, the attacker can access all data accessible to the user, including documents, credentials, browser data, and email. Integrity (High): the attacker can modify files, install malware, create persistence mechanisms, and alter system configurations. Availability (High): ransomware deployment, system destruction, or resource exhaustion can render the system unusable. The user interaction requirement is easily met through social engineering, as archive files are commonly shared via email attachments, file-sharing platforms, and messaging applications, making this an ideal vector for targeted spear-phishing and mass distribution campaigns.
Exploit Maturity
CVE-2025-8088 was exploited as a zero-day vulnerability in the wild before RARLAB released a patch, with ESET researchers Anton Cherepanov, Peter Kosinár, and Peter Strýček discovering the exploitation. CISA has confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 3.83% at the 87th percentile indicates substantial exploitation activity. According to press coverage, at least two threat groups exploited this zero-day for weeks before disclosure. Third-party analysis is available from Vicarius with detection guidance, and mitigation strategies using SRP and IFEO have been published. The weaponization of file archiver vulnerabilities remains a proven attack strategy, as demonstrated by previous WinRAR exploitation campaigns.
Remediation
-
Update WinRAR to version 7.13 or later immediately. This version addresses the path traversal vulnerability. Download the update exclusively from the official WinRAR website.
-
Update dtSearch to version 2023.01 or later if installed, as this product also bundles a vulnerable component affected by CVE-2025-8088. Refer to the dtSearch advisory for details.
-
Implement email and web gateway filtering to scan archive attachments for malicious content. Configure filters to quarantine or block archive files from untrusted sources, particularly those containing executable content or suspicious path structures.
-
Educate users about the risk of opening archive files from unknown or untrusted sources. Given the user interaction requirement, awareness training is a critical defensive measure against this attack vector.
-
Deploy application control policies such as Software Restriction Policies (SRP) or Image File Execution Options (IFEO) as an interim mitigation to prevent execution of files extracted to unexpected locations. Monitor endpoints for indicators of compromise including unexpected file writes outside of standard extraction directories.
Technical Details
CVE-2025-8088 is a path traversal vulnerability in WinRAR's archive extraction logic. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-delivered attack with low complexity that requires user interaction (opening the archive) but no authentication. The vulnerability allows an attacker to craft a malicious archive file containing entries with directory traversal sequences that bypass WinRAR's path sanitization. When the victim extracts or previews the archive, files are written to locations outside the intended extraction directory. By placing an executable or script in a startup folder, scheduled task directory, or another auto-execution location, the attacker achieves arbitrary code execution the next time the system processes that location. The attack was exploited as a zero-day by at least two threat groups before the patch in version 7.13 was released. WinRAR versions prior to 7.13 on Windows are affected, and the fix implements stricter path validation during archive extraction to prevent traversal beyond the target directory.
Frequently Asked Questions
Is CVE-2025-8088 being actively exploited?
Yes. CVE-2025-8088 was exploited as a zero-day vulnerability by multiple threat groups before a patch was available. CISA has confirmed active exploitation and added it to the KEV catalog. ESET researchers discovered the exploitation in the wild.
What products are affected by CVE-2025-8088?
RARLAB WinRAR versions prior to 7.13 on Windows are vulnerable. Additionally, dtSearch versions prior to 2023.01 are affected as they bundle a vulnerable component.
How do I fix CVE-2025-8088?
Update WinRAR to version 7.13 or later from the official website. If you use dtSearch, update to version 2023.01 or later. Additionally, implement email filtering for archive attachments and educate users about risks of opening untrusted archives.
How severe is CVE-2025-8088?
CVE-2025-8088 has a CVSS v3.1 score of 8.8 (High severity). It enables arbitrary code execution through crafted archive files and was actively exploited as a zero-day, making it a critical-priority update for all WinRAR users.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.