PT-2025-32352 · Rarlab+1 · Winrar

Anton Cherepanov + 2 · Published 2025-07-30 · Updated 2026-06-29 · CVE-2025-8088

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 7.13

Description A path traversal vulnerability in the Windows version of WinRAR allows attackers to execute arbitrary code by crafting malicious archive files. The issue stems from improper restriction of directory path names, enabling the extraction process to escape the target directory and write files into restricted system folders, such as the Startup folder. This allows for the automatic execution of malicious code in the context of the current user. This flaw has been exploited in the wild by various APT groups, including Amaranth-Dragon and Gamaredon, to target government and military networks for cyber-espionage.

Recommendations Update WinRAR to version 7.13 or newer.

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2025-09597

CVE-2025-8088

Affected Products

Winrar

References · 703

• https://win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 · Security Note
• https://bdu.fstec.ru/vul/2025-09597 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8088 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8088 · Vendor Advisory
• https://github.com/stamparm/maltrail · Note
• https://github.com/sta/websocket-sharp · Note
• https://github.com/eset/malware-ioc · Note
• https://github.com/bartblaze/Yara-rules · Note
• https://github.com/HarfangLab/iocs · Note
• https://twitter.com/ESETresearch/status/1954831154697175392 · Twitter Post
• https://twitter.com/UndercodeNews/status/2016238672450896365 · Twitter Post
• https://t.me/pentestingnews/66393 · Telegram Post
• https://twitter.com/ThreatSynop/status/2019079376550408208 · Twitter Post
• https://twitter.com/HarborcoatIntel/status/1954890829903827129 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1sjagpl/top_10_trending_cves_12042026 · Reddit Post