CVE-2025-8088: WinRAR path traversal lets crafted archives execute code

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a confirmed in-the-wild exploited path traversal with arbitrary code execution, KEV listing, ransomware campaign use and near-maximum EPSS probability.

What it is

CVE-2025-8088 is a path traversal flaw in the Windows version of WinRAR that allows attackers to execute arbitrary code by crafting malicious archive files. It was exploited in the wild and discovered by ESET researchers, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is a confirmed active threat rather than a theoretical one.

Impact

An attacker who gets a victim to open a malicious archive can write files outside the intended extraction directory and achieve arbitrary code execution in the context of the user. This gives full compromise of confidentiality, integrity and availability on the affected host.

Attack surface

The vector is local (AV:L) with user interaction required (UI:A) and no privileges required (PR:N), meaning the attacker must deliver a crafted archive and convince the user to open or extract it. No authentication is needed; the archive is the delivery mechanism.

Exploitation

CISA KEV lists it as exploited in the wild since 2025-08-12 with known ransomware campaign use, and EPSS gives a 30-day probability of 0.938 (99.8th percentile). Reference tags include press coverage of active exploitation by multiple groups, confirming real-world attacks.

What to do

• Update WinRAR to the latest vendor release that fixes the path traversal; check the WinRAR release notes for the patched version.
• Apply the vendor and CISA required actions, including BOD 22-01 guidance for cloud services, or discontinue use if patching is not possible.
• Use the documented mitigation of Software Restriction Policies and Image File Execution Options to block exploitation paths where patching is delayed.
• Restrict or block archive file execution and extraction from untrusted sources such as email attachments and downloads.
• Audit endpoints for WinRAR and DTSearch installations and prioritize patching on systems exposed to user-supplied archives.

Detection

• Monitor for archive extraction processes writing files to unexpected paths outside the intended destination, especially startup folders and system directories.
• Hunt for WinRAR or DTSearch child processes spawning script interpreters, command shells or other unexpected executables after archive handling.
• Review file creation events in sensitive locations (Startup, Temp, System32) correlated with recent archive opens.
• Alert on known exploitation indicators from the ESET and Vicarius detection write-ups, including suspicious archive filenames and traversal sequences.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.