CVE-2025-8088 RARLAB WinRAR Path Traversal
Attackers can execute arbitrary code by crafting malicious archive files, requiring users to update WinRAR to mitigate this actively exploited vulnerability.
- Exploited in the wild
- Since 12 Aug 2025
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-8088?
CVE-2025-8088 is a high-severity path traversal vulnerability in win.rar GmbH WinRAR, published on 8 Aug 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
Weakness: CWE-35
Which versions are affected by CVE-2025-8088?
It affects 2 products.
Products include Dtsearch Dtsearch, Rarlab Winrar.
How do I fix CVE-2025-8088?
Upgrade to a fixed version. US federal agencies must fix it by 2 Sep 2025.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-8088 being exploited?
Yes. Attackers have exploited CVE-2025-8088 in the wild since at least 12 Aug 2025, including in ransomware campaigns.
Public exploit code: 30 proofs of concept on GitHub.
Other vulnerabilities in win.rar GmbH WinRAR
Sources
Also known as GHSA-832g-3rcm-wcrf, MINI-9hmf-624v-wh2w, MINI-r98c-2pfh-2854.