Product and affected versions
WinRAR for Windows, along with the Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll, up to and including version 7.12. WinRAR for Unix-like systems and RAR for Android are not affected.
Severity and CVE ID
The flaw is tracked as CVE-2025-8088 with a CVSS score of 8.8 (High). On August 12, 2025, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation.
Vulnerability
CVE-2025-8088 is a path traversal vulnerability. When WinRAR extracts a specially crafted archive, it can be tricked into writing files outside the folder the user chose, for example into the Windows Startup folder, so the attacker’s code runs the next time the user logs in.
How the attack works
Researchers at ESET found the flaw being exploited as a zero-day in spear-phishing campaigns attributed to the Russia-aligned RomCom group. Victims received emails with malicious RAR attachments disguised as job applications or similar documents. The archives used alternate data streams (ADS) to hide malicious files, which were dropped into sensitive locations when the archive was opened, leading to the installation of backdoors.
Remediations
- Update WinRAR to version 7.13 or later. WinRAR does not update itself, so each installation must be updated manually.
- Update other software that bundles UnRAR.dll or the portable UnRAR source code.
- Be cautious with archive attachments from unknown senders, and monitor the Startup folders for unexpected files.
Reference
The vulnerability was discovered and reported by ESET researchers. See RARLAB’s WinRAR 7.13 release notes and the NVD entry for CVE-2025-8088.
Correction: an earlier version of this article incorrectly identified the vulnerability as CVE-2023-40477, an unrelated 2023 WinRAR flaw.
