CVE-2025-8088
RARLAB WinRAR Path Traversal Vulnerability
RARLAB WinRARLibraries & packages
CVSS
8.4HighExploit odds (EPSS)94.5%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
Description
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
Text from CVE List
Affected versions 1
- WinRARaffected: all versions through 7.12CVE List
References 8
- welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088Advisoryvia CVE List
- arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/Advisoryvia CVE List
- win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5Referencevia CVE List
- nvd.nist.gov/vuln/detail/CVE-2025-8088Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088Referencevia CVE List
- vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-dayReferencevia CVE List
- vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeoReferencevia CVE List
- support.dtsearch.com/faq/dts0245.htmReferencevia CVE List