KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-8088
8.8
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityRARLAB WinRAR Path Traversal Vulnerability
VendorRARLAB
ProductWinRAR
Date added2025-08-12
Due date2025-09-02
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-35
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Descriptions
KEV: RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
NVD: A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Kosinar, and Peter Strydek from ESET.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-09-08 21:43 UTC
Searches4
Component defaultyes
Sources
https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/
https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability
https://github.com/ghostn4444/CVE-2025-8088
https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-
https://mallory.ai/vulnerabilities/CVE-2025-8088
https://nvd.nist.gov/vuln/detail/CVE-2025-8088
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088
https://www.dtg.com/post/cve-2025-8088-winrar-ads-escape
https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
https://www.opswat.com/blog/cve-2025-8088-technical-analysis-winrar-arbitrary-file-write-through-ads
https://dailysecurityreview.com/security-spotlight/winrar-zero-day-cve-2025-8088-exploited-in-phishing-attacks-to-drop-romcom-backdoors/
https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability
https://github.com/ghostn4444/CVE-2025-8088
https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-
https://mallory.ai/vulnerabilities/CVE-2025-8088
https://nvd.nist.gov/vuln/detail/CVE-2025-8088
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088
https://www.dtg.com/post/cve-2025-8088-winrar-ads-escape
https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
https://www.opswat.com/blog/cve-2025-8088-technical-analysis-winrar-arbitrary-file-write-through-ads
https://dailysecurityreview.com/security-spotlight/winrar-zero-day-cve-2025-8088-exploited-in-phishing-attacks-to-drop-romcom-backdoors/
Hunting hypothesis agent
Hunt Sysmon EID 11 for WinRAR.exe writing .lnk/.bat to Startup after extracting RAR5 with colon-ADS filenames; ghostn4444 PoC patches headers replacing X-placeholder streams with traversal paths to drop persistence outside extraction dir.
Research details
ComponentArchive extraction engine NTFS Alternate Data Stream (ADS) path validation — colon syntax in RAR5 filenames bypasses extraction directory boundary checks
PreconditionsThe victim must have WinRAR for Windows version 7.12 or earlier installed. The attacker delivers a specially crafted RAR5 archive containing filenames that abuse NTFS Alternate Data Stream (ADS) syntax to embed path traversal sequences (../). The victim must extract the archive using a vulnerable version of WinRAR. Upon extraction, the malicious ADS payload is written outside the intended extraction directory, typically to the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) for persistence. No authentication is required for the attacker; the attack relies on user interaction (extracting the archive). agent
DeliveryPoC (poc.py) attaches payload as NTFS ADS on a decoy file using 'X'*128 placeholder, creates a base RAR5 archive with rar.exe -os flag, then patches the binary to replace ':XXXXXXXX...' with a traversal path (..\\..\\ default depth 16) targeting an arbitrary directory. Upon extraction by WinRAR <= 7.12, the ADS stream name is misinterpreted as a file path, writing the payload outside the extraction directory. In-the-wild actors target the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) with .lnk shortcuts, .bat scripts, and HTA files for persistence and code execution on next login.
Public PoCyes
PoC URLs
https://github.com/Jessica74016/CVE-2025-8088
https://github.com/ghostn4444/CVE-2025-8088
https://github.com/lennertdefauw/CVE-2025-8088
https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-
https://github.com/pentestfunctions/best-CVE-2025-8088
https://github.com/pentestfunctions/CVE-2025-8088-Multi-Document
https://github.com/patricnilackshan/CVE-2025-8088-WinRAR-POC
https://github.com/AdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal Third-party repos; verify before use.
https://github.com/ghostn4444/CVE-2025-8088
https://github.com/lennertdefauw/CVE-2025-8088
https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-
https://github.com/pentestfunctions/best-CVE-2025-8088
https://github.com/pentestfunctions/CVE-2025-8088-Multi-Document
https://github.com/patricnilackshan/CVE-2025-8088-WinRAR-POC
https://github.com/AdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | Multiple public PoCs (ghostn4444, sxyrxyy, Jessica74016, pentestfunctions) demonstrate weaponized archive generation. The ghostn4444 PoC (poc.py, Exploit_cve_2025_8088.ps1) builds malicious RAR5 archives using NTFS ADS colon-syntax (decoy.txt:XXXXXXXX) with configurable --max_up traversal depth (default 16) targeting the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\). The poc.py creates a payload, attaches it as an ADS stream on a decoy file using 'X'*128 placeholder, then patches the RAR5 binary to replace ':'+placeholder with the traversal path (e.g. ..\\..\\\\ with 16 levels). Recalculates CRC32 for all RAR5 header blocks. The sxyrxyy PoC constructs raw RAR5 binary format with HEADER_FLAG_EXTRA (0x0001) AND HEADER_FLAG_DATA (0x0002) embedding ADS payloads. The patricnilackshan PoC uses Python rarfile module to inject ADS entries. In-the-wild exploitation by RomCom APT (Storm-0978), APT44, Turla, and Chinese actors used spearphishing emails with RAR files disguised as job applications. The colon character in the ADS filename bypasses WinRAR path validation while NTFS interprets it as a stream separator. Patched in WinRAR 7.13 (July 30, 2025).
SummaryCVE-2025-8088 is a high-severity path traversal vulnerability in WinRAR for Windows (versions 7.12 and earlier) that allows attackers to write arbitrary files to any location on the system by exploiting NTFS Alternate Data Streams (ADS) syntax in crafted RAR archive filenames. When a victim extracts a malicious archive, the ADS payload traverses out of the intended extraction directory — typically targeting the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) for persistence — enabling arbitrary code execution on the next user login. The vulnerability was discovered by ESET in mid-July 2025, exploited in-the-wild by Russian (RomCom, APT44, Turla) and Chinese APT groups as well as financially motivated actors, and patched in WinRAR 7.13.
Tia coverage
First reported2026-05-19
First exploit report2026-07-19
Exploit report → KEV341 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
7-zip-26-02-rce-via-heap-based-buffer-overflow-in-xz-decompressigamaredon-apt-launches-fileless-campaign-against-ukraine-gammawogamaredon-uac-0010-sustains-12-wave-phishing-campaign-against-ukturla-s-stockstay-backdoor-google-exposes-russian-fsb-aligned-ap
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.