CVE-2025-8088
Path traversal vulnerability in WinRAR
KEV RANSOMWAREHIGH 8.4EPSS 94.5%
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
- Affected
- win.rar GmbH · WinRAR
- CVSS v4.0 ESET
- 8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 94.51% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-08-12, used in ransomware campaigns
- Published
- 2025-08-08
- Updated
- 2026-08-11
Proof-of-concept exploits (38)
- 0xAbolfazl/CVE-2025-8088-WinRAR-PathTraversal-PoC1★ · 2025-08-16
- AdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal12★ · 2025-08-26
- Shinkirou789/Cve-2025-8088-WinRar-vulnerability1★ · 2025-09-17
- Syrins/CVE-2025-8088-Winrar-Tool-Gui4★ · 2025-08-20
- drburakbaysan/drbb_winrar_traversal_exploit0★ · 2025-08-14
- ghostn4444/CVE-2025-80880★ · 2025-08-29
- hbesljx/CVE-2025-8088-EXP0★ · 2025-09-18
- hexsecteam/CVE-2025-8088-Winrar-Tool50★ · 2025-09-04
- jordan922/CVE-2025-808810★ · 2025-08-11
- kitsuneshade/WinRAR-Exploit-Tool---Rust-Edition8★ · 2025-08-30
- knight0x07/WinRAR-CVE-2025-8088-PoC-RAR44★ · 2025-08-12
- nhattanhh/CVE-2025-80880★ · 2025-08-19
- onlytoxi/CVE-2025-8088-Winrar-Tool55★ · 2025-08-18
- pentestfunctions/CVE-2025-8088-Multi-Document35★ · 2025-08-17
- pentestfunctions/best-CVE-2025-808810★ · 2025-08-27
- pescada-dev/-CVE-2025-80881★ · 2025-08-26
- pexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC2★ · 2025-08-17
- sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-73★ · 2025-08-13
- tasox/rarADSExtractor1★ · 2025-09-02
- techcorp/CVE-2025-8088-Exploit0★ · 2025-10-29
- travisbgreen/cve-2025-80881★ · 2025-08-11
- walidpyh/CVE-2025-80885★ · 2025-08-27
- IsmaelCosma/CVE-2025-80880★ · 2026-02-11
- Lewis-Ricardo/Amaranth-Project0★ · 2026-06-26
- aldisakti2/CVE-2025-8088-BUILDER-Winrar-Tool28★ · 2025-10-20
- lennertdefauw/CVE-2025-80885★ · 2026-03-25
- nuky-alt/CVE-2025-80880★ · 2025-11-03
- papcaii2004/CVE-2025-8088-WinRAR-builder0★ · 2025-10-27
- shaheeryasirofficial/CVE-2025-80880★ · 2026-04-07
- skander1337/winrar-exploit0★ · 2025-09-25
- undefined-name12/CVE-2025-8088-Winrar2★ · 2026-02-14
- xi0onamdev/WinRAR-CVE-2025-8088-Exploitation-Toolkit0★ · 2025-11-29
- UnHackerEnCapital/BatiRaR7★ · 2026-03-14
- UnHackerEnCapital/PepRaR11★ · 2026-02-05
- k1tbro/Homework-No.-10-HSE-University0★ · 2026-02-13
- roof1948576qwd/CVE-2025-8088-WinRAR-PoC-20★ · 2026-09-29
- roof1948576qwd/CVE-2025-8088-WinRAR-PoC-30★ · 2026-09-29
- roof1948576qwd/CVE-2025-8088-WinRAR-PoC-10★ · 2026-09-29
Security advisories
- https://support.dtsearch.com/faq/dts0245.htm
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-a…
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8…