{"id":"CVE-2025-8088","published":"2025-08-08T12:15:29Z","modified":"2026-08-11T04:17:18Z","title":"RARLAB WinRAR Path Traversal Vulnerability","vendor":"RARLAB","product":"WinRAR","tier":"core","eol":null,"description":{"text":"A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček\n     from ESET.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in the Windows version of RARLAB's WinRAR archive utility lets specially crafted archive files write or place content outside the intended extraction directory. An attacker needs to get a malicious archive to a user who opens or extracts it with WinRAR, which requires user interaction and no prior authentication or network access to the target.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:54Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.94008,"percentile":0.99846,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-08-12","dueDate":"2025-09-02","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8088","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-08","exploitedFirstSeen":"2025-08-08","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8088","date":"2025-08-08"},{"url":"https://www.acn.gov.it/portale/w/rilevato-sfruttamento-in-rete-della-cve-2025-8088-relativa-a-winrar","date":"2025-08-11"},{"url":"https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/","date":"2025-08-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-12"},{"url":"https://asec.ahnlab.com/ko/89806/","date":"2025-08-25"},{"url":"https://www.seqrite.com/blog/winrar-directory-traversal-ntfs-ads-vulnerabilities-cve-2025-6218-cve-2025-8088/","date":"2025-08-25"},{"url":"https://blog.qualys.com/product-tech/2025/09/05/cve-2025-8088-winrar-exploit-from-zero-day-to-zero-risk-with-trurisk-eliminate","date":"2025-09-05"},{"url":"https://www.recordedfuture.com/blog/august-2025-cve-landscape","date":"2025-09-15"},{"url":"https://cyble.com/blog/vulnerabilities-under-attack/","date":"2025-09-23"},{"url":"https://www.morphisec.com/blog/windows-10-end-of-life-why-businesses-delay-the-risks-and-how-to-prepare/","date":"2025-09-30"}],"evidenceTotal":63,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"BREAK THE SILENCE: Tracking Silent Lynx Through Exposed Infrastructure","url":"https://otx.alienvault.com/pulse/6ae2841d3d49c6b5b1e6adaf","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"EbeeOct2026 Pt4","url":"https://otx.alienvault.com/pulse/6ad87c6c085d1e0d032d9ad9","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-35","name":"Path Traversal: '.../...//'"}],"references":[{"url":"https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5","tags":["Release Notes"]},{"url":"https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/","tags":["Press/Media Coverage"]},{"url":"https://support.dtsearch.com/faq/dts0245.htm","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088","tags":["US Government Resource"]},{"url":"https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088","tags":["Press/Media Coverage"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: victim opens crafted archive file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows the attackers to execute arbitrary code by crafting malicious archive files","start":71,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution achieved by the exploit","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows the attackers to execute arbitrary code by crafting malicious archive files","start":71,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-23983","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23983","exploited":true,"exploitedSince":"2025-08-12","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":27,"skipped":3,"earliest":"2025-08-10","earliestUrl":"https://github.com/jordan922/CVE-2025-8088","repos":[{"name":"sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-","url":"https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-","stars":72,"created":"2025-08-13"},{"name":"onlytoxi/CVE-2025-8088-Winrar-Tool","url":"https://github.com/onlytoxi/CVE-2025-8088-Winrar-Tool","stars":55,"created":"2025-08-14"},{"name":"hexsecteam/CVE-2025-8088-Winrar-Tool","url":"https://github.com/hexsecteam/CVE-2025-8088-Winrar-Tool","stars":50,"created":"2025-09-04"},{"name":"knight0x07/WinRAR-CVE-2025-8088-PoC-RAR","url":"https://github.com/knight0x07/WinRAR-CVE-2025-8088-PoC-RAR","stars":44,"created":"2025-08-12"},{"name":"pentestfunctions/CVE-2025-8088-Multi-Document","url":"https://github.com/pentestfunctions/CVE-2025-8088-Multi-Document","stars":35,"created":"2025-08-16"}]},"first":{"date":"2025-08-10","source":"PoC-in-GitHub","url":"https://github.com/jordan922/CVE-2025-8088"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-08-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8088","provenance":"source"},{"date":"2025-08-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2025-8088","provenance":"source"},{"date":"2025-08-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/jordan922/CVE-2025-8088","provenance":"source"},{"date":"2025-08-12","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-08-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23983","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":79.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 449 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"27 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}