PT-2025-32352 · Rarlab +1 · Winrar

Anton Cherepanov

+2

·

Published

2025-07-30

·

Updated

2025-09-15

·

CVE-2025-8088

CVSS v3.1
8.8
VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

WinRAR versions prior to 7.13

**Description:**

A path traversal vulnerability exists in WinRAR, allowing attackers to execute arbitrary code by crafting malicious archive files. This vulnerability has been actively exploited in the wild by multiple threat actors, including the Russia-linked RomCom group and Paper Werewolf. Exploitation involves embedding malicious payloads within RAR archives that, when extracted, place files in unauthorized locations, such as the Windows Startup folder, leading to automatic malware execution upon system login. The vulnerability allows attackers to bypass security measures and gain unauthorized access to systems.

**Recommendations:**

Update WinRAR to version 7.13 or later immediately. As WinRAR does not feature automatic updates, manual intervention is required to apply the fix.

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2025-09597
CVE-2025-8088

Affected Products

Winrar