CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability
Vulnerability summary
CVE-2025-8088 is a high (CVSS 8.8) Path Traversal: '.../...//' vulnerability in RARLAB WinRAR. It is known to be exploited: CISA lists it, first on 12-08-2025. It has been used in ransomware campaigns. EPSS estimates a 94.51% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 08-08-2025PublishedVulnerability first disclosed.
- 12-08-2025Added to CISA KEVRARLAB WinRAR Path Traversal Vulnerability
- 02-09-2025CISA remediation dueApply mitigations per vendor instructions.
- 11-08-2026Last modifiedVulnerability information updated.
Description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
94.51%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+0.46 pp
From 94.05% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 12-08-2025
- Federal due date
- 02-09-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. www.win-rar.com/singlenewsview.html nvd.nist.gov/vuln/detail/CVE-2025-8088
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products
References
7 links- www.win-rar.com/singlenewsview.htmlRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088Government ResourceUS Government Resource
- www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-dayThird Party Advisory
- www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeoMitigationThird Party Advisory
- support.dtsearch.com/faq/dts0245.htmThird Party Advisory