Path traversal vulnerability in WinRAR (win.rar GmbH WinRAR)
At a glance
- Source
- NVD
- EPSS
- EPSS 94.01 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ESET
- NVD status
- Analyzed
Description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
Weaknesses (CWE)
- CWE-35 — Path Traversal: '.../...//'
References
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo
- https://support.dtsearch.com/faq/dts0245.htm
- https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | ESET |
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security@eset.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-23983
- GCVE · GCVE-0-2025-8088
CERT-FR advisories
- CERTFR-2026-AVI-0992 — Multiples vulnérabilités dans ClamAV · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*< 7.13cpe:2.3:a:dtsearch:dtsearch:*:*:*:*:*:*:*:*< 2023.01
Affected products
| Product | Versions |
|---|---|
| win.rar GmbH · WinRAR | affected 0 ≤ 7.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |