WinRAR Update: Zero-Day Path Traversal Flaw (CVE-2025-8088) Actively Exploited to Deliver Malware
Do Son 
Security researchers at ESET have uncovered a zero-day path traversal vulnerability in the Windows version of WinRAR that has been actively exploited to execute arbitrary code on victimsβ systems. Tracked as CVE-2025-8088 and carrying a CVSS v3.1 score of 8.4, this flaw could allow attackers to hijack a userβs extraction process and plant malicious files in unintended system locations.
When extracting files from an archive, vulnerable versions of WinRAR β including previous Windows releases of RAR, UnRAR, the portable UnRAR source code, and UnRAR.dll β could be tricked into using a file path embedded in a specially crafted archive, rather than the userβs chosen destination path.
This opens the door for attackers to:
- Place malicious files in sensitive directories.
- Overwrite critical system or application files.
- Execute arbitrary code upon file extraction without further user interaction.
ESETβs researchers, Anton Cherepanov, Peter KoΕ‘inΓ‘r, and Peter StrΓ½Δek, emphasized that this flaw has already been weaponized in real-world attacks. The exploitation chain starts with a malicious archive delivered via phishing or another social engineering method, which β when extracted β silently places and runs malware.
Who Is Affected
- Affected: Windows versions of WinRAR and related extraction components (RAR, UnRAR, portable UnRAR source code, UnRAR.dll).
- Not affected: Unix versions of RAR/UnRAR, the portable UnRAR source code and library for Unix, and RAR for Android.
ESET confirmed that βthis vulnerability was exploited in the wildβ, making it a critical concern for both individual users and organizations relying on WinRAR for compressed file handling. Zero-day exploitation means threat actors had access to and leveraged this flaw before a patch was available.
The vulnerability has been fixed in WinRAR 7.13, which is now available from the official WinRAR website. All Windows users are strongly urged to:
- Update immediately to WinRAR 7.13 or later.
- Avoid opening archives from untrusted sources.
- Consider scanning archives with updated endpoint protection before extraction.
Related Posts:
- Warning: Fake WinRar Websites Distributing Malware
- Google TAG Alerts on Exploitation of WinRAR Vulnerability by State-Backed Hackers
- WinRAR Code Execution Vulnerability
- CVE-2025-6218: WinRAR Directory Traversal Bug Opens the Door to Remote Code Execution
- Hackers exploit CVE-2023-38831 zero-day vulnerability in WinRAR
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
