CVE-2025-8088
Published 2025-08-08 · Updated 2026-08-11 · Source security@eset.com
Summary
CVE-2025-8088 is a high-severity (CVSS 8.8) vulnerability in RARLAB WinRAR. CISA added it to the Known Exploited Vulnerabilities catalog on August 12, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 2, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. RARLAB has 5 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.
All 5 known-exploited RARLAB vulnerabilities →Description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: RARLAB — WinRAR
Name: RARLAB WinRAR Path Traversal Vulnerability
Date added: 2025-08-12 · Due: 2025-09-02
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
- https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/
- https://support.dtsearch.com/faq/dts0245.htm
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088
- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088