RARLAB · WinRAR
CVE-2025-8088
Path traversal vulnerability in WinRAR
What it is
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček
from ESET.
CISA: RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 2, 2025
More exploited flaws from RARLAB
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 9, 2025 | Path Traversal | WinRAR | High 7.8 | 90% |
| Aug 24, 2023 | Code Execution | WinRAR | High 7.8 | 99.8% |
| Feb 15, 2022 | Absolute Path Traversal | WinRAR | High 7.8 | 96% |
| Aug 9, 2022 | Directory Traversal | UnRAR | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.