HIGH Actively exploited Used in ransomware CWE-35
CVE-2025-8088
Path traversal vulnerability in WinRAR
RARLAB·WinRAR
8.4/ 10
CVSS 4.0
High severity
94%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.9% of all CVEs
Listed
CISA KEV catalog
- Added
- Aug 12, 2025
- Fix due
- Sep 2, 2025
- Ransomware
- Known use
Timeline
- Published
- Aug 8, 2025
- Updated
- Aug 11, 2026
- First covered
- Jul 18, 2026
- Latest story
- 4 months ago
Summary
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CWE-35Path traversal
Attack profile
Attack vectorLocal
ComplexityLow
RequirementsNone
PrivilegesNone
User interactionActive
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Win.rar WinRARup to 7.12