This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] WinRAR fixes an actively exploited vulnerability
WinRAR version 7.13 fixes a high-severity, actively exploited vulnerability [1]. The vulnerability affects only the Windows version of this tool.
An unauthenticated remote attacker, by means of social engineering and a specially crafted archive, is able to exploit a path traversal flaw to place files outside the target directory, which may lead to code execution on the victim's system. In addition to WinRAR, the Windows versions of RAR, UnRAR, UnRAR.dll and the portable UnRAR source code are also affected [1][2]. According to available information, the vulnerability is already being actively exploited in targeted spearphishing campaigns [3][4][5].
The vulnerability is present in product:
- WinRAR; <=7.12;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-8088 at cve.org, NVD
- CWE-35: Path Traversal: '.../...//' at cwe.mitre.org
The vulnerability was publicly disclosed 8. 8. 2025.
Links
- [1] https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
- [2] https://nvd.nist.gov/vuln/detail/CVE-2025-8088
- [3] https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
- [4] https://www.helpnetsecurity.com/2025/08/11/winrar-zero-day-cve-2025-8088/
- [5] https://thehackernews.com/2025/08/winrar-zero-day-under-active.html
By CESNET, z.s.p.o. Michaela Ručková on 11. 8. 2025.