CVE-2025-8088KEV · OVERDUECWE-35

RARLAB WinRAR Path Traversal Vulnerability

High · published August 8, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

417
days past CISA
deadline
CVSS v3.1
8.8
EPSS
95%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A crafted malicious archive file can unleash chaos! This path traversal vulnerability in WinRAR can let attackers execute arbitrary code, like a sneaky magician pulling rabbits out of a hat! 🔥 Think of WinRAR as a delivery service that opens packages. If the delivery driver decides to snoop around and take anything from the wrong package, that's a serious breach of trust! This vulnerability allows that kind of unauthorized access to your files by exploiting how WinRAR handles paths. An attacker could create a malicious archive that, when opened, executes code on your system. This means they could potentially take control of your computer, steal sensitive data, or install malware. The consequences could be absolutely devastating if left unaddressed!

Put simply

Think of WinRAR as a delivery service that opens packages. If the delivery driver decides to snoop around and take anything from the wrong package, that's a serious breach of trust! This vulnerability allows that kind of unauthorized access to your files by exploiting how WinRAR handles paths. This vulnerability allows attackers to exploit path traversal by crafting archive files that manipulate directory paths, enabling them to execute arbitrary code on the affected Windows versions of WinRAR.

What to do

An attacker could create a malicious archive that, when opened, executes code on your system. This means they could potentially take control of your computer, steal sensitive data, or install malware. The consequences could be absolutely devastating if left unaddressed! Update WinRAR to the latest version immediately to patch this vulnerability. Review your systems to ensure that no malicious archives have been accessed, and consider implementing file-scanning measures to prevent such exploits in the future. You can tackle this head-on! Follow these steps, and you’ll have your defenses locked down in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.94509 · 99.9th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2025-08-08T16:15Z
KEV added
2025-08-12 · due 2025-09-02
Affected products (2)
ProductVersionsFixed in
rarlab/winrar< 7.137.13
dtsearch/dtsearch< 2023.012023.01
References (7)
EPSS history
Timeline
  • 12 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 2
    kev
  • 08 AUG 11:11Z
    Path traversal vulnerability in WinRAR
    cvelistv5