Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-8088

RARLAB WinRAR Path Traversal Vulnerability

8.8
CVSS 3.1
1
story
AUG 12
added to KEV
Severity
8.8 High · NVD score
Vendor
RARLAB
Product
WinRAR
Published
Aug 8, 2025
Added to KEV
Aug 12, 2025
KEV deadline
Sep 2, 2025
Ransomware use
Known
Weakness
CWE-35

What it is

RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. IntrusionsCybercrime and APT Groups Exploiting WinRAR BugExploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.DENNIS FISHER · 4 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixvicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeoAnalysissupport.dtsearch.com/faq/dts0245.htmAnalysisvicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day