CVE-2025-8088

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8088
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 Release Notes
https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo Mitigation Third Party Advisory
https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088 Press/Media Coverage
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

18 Aug 2025, 13:08

Type Values Removed Values Added
References () https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day - () https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day - Third Party Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo - () https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo - Mitigation, Third Party Advisory

15 Aug 2025, 16:15

Type Values Removed Values Added
Summary (en) A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strý?ek from ESET. (en) A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
References
  • () https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day -
  • () https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo -

13 Aug 2025, 19:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 - () https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 - Release Notes
References () https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088 - () https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088 - Press/Media Coverage
Summary (es) Una vulnerabilidad de recorrido de ruta que afecta a la versión de WinRAR para Windows permite a los atacantes ejecutar código arbitrario mediante la creación de archivos maliciosos. Esta vulnerabilidad fue explotada indiscriminadamente y descubierta por Anton Cherepanov, Peter Košinár y Peter Strý?ek de ESET. (es) Una vulnerabilidad de path traversal que afecta a la versión de WinRAR para Windows permite a los atacantes ejecutar código arbitrario mediante la manipulación de archivos maliciosos. Esta vulnerabilidad fue explotada indiscriminadamente y descubierta por Anton Cherepanov, Peter Košinár y Peter Strý?ek de ESET.
CPE cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
First Time Microsoft
Microsoft windows
Rarlab winrar
Rarlab

13 Aug 2025, 01:00

Type Values Removed Values Added
Summary (en) A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. (en) A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strý?ek from ESET.

12 Aug 2025, 15:15

Type Values Removed Values Added
References
  • () https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088 -
Summary
  • (es) Una vulnerabilidad de recorrido de ruta que afecta a la versión de WinRAR para Windows permite a los atacantes ejecutar código arbitrario mediante la creación de archivos maliciosos. Esta vulnerabilidad fue explotada indiscriminadamente y descubierta por Anton Cherepanov, Peter Košinár y Peter Strý?ek de ESET.

08 Aug 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-08 12:15

Updated : 2025-08-18 13:08

NVD link : CVE-2025-8088

Mitre link : CVE-2025-8088

CVE.ORG link : CVE-2025-8088

JSON object : View

Products Affected

rarlab

  • winrar

microsoft

  • windows
CWE
CWE-35

Path Traversal: '.../...//'