Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Exploited vulnerability
WinRAR CVE-2025-8088: path traversal flaw and fix
A path traversal flaw in WinRAR for Windows.
- On CISA KEV
- CVE ID
- CVE-2025-8088
- CVSS
- 8.8 High (CVSS v3.1, NVD); 8.4 High (CVSS v4.0, from ESET in NVD)
- CISA KEV
- Listed
- Affected product
- WinRAR for Windows, plus RAR, UnRAR, UnRAR.dll and the portable UnRAR source code on Windows
- Exploited
- Seen from 18 July 2025 (attributed by ESET); CISA KEV listing 12 August 2025
- Published
- 8 August 2025
In short
CVE-2025-8088 is a path traversal flaw in WinRAR for Windows. A crafted archive can write files outside the folder the user picked, and that can lead to code running on the PC. It was exploited before the fix came out, and CISA lists it as exploited, with known ransomware campaign use.
- CVECVE-2025-8088
- ProductRARLAB WinRAR for Windows, plus RAR, UnRAR, UnRAR.dll and the portable UnRAR source code on Windows
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpdate to WinRAR 7.13 or later · Find hidden copies of old code
What it allows
A person who opens or extracts a crafted RAR archive can have files written to places they did not choose. ESET found that the attack used NTFS alternate data streams. Hidden files, a DLL and a shortcut for the Windows Startup folder, were written in silence, and the shortcut made the payload run at the next sign-in. Extra streams with dummy data and invalid paths triggered WinRAR warnings, so the malicious DLL and shortcut paths were easy to miss.
Attacks were reported in two waves. ESET attributed the first spear-phishing campaigns, from 18 to 21 July 2025, to the RomCom group, and said a second actor followed a few days later. In April 2026 Cisco Talos saw a RAR file with this flaw place the PickleShell reverse shell in the Startup folder, in a campaign against government bodies that it attributes to the group UAT-6275, known as Silent Lynx.
Who is affected
RARLAB says previous versions of WinRAR, the Windows versions of RAR, UnRAR, the portable UnRAR source code and UnRAR.dll can be tricked into using a path from a crafted archive. The Unix versions of RAR and UnRAR, their source code and library, and RAR for Android are not affected. NVD lists WinRAR before 7.13, and also dtSearch before 2023.01.
The fix is WinRAR 7.13 final, released on 30 July 2025. It is a different bug from the traversal flaw fixed in 7.12. Update to 7.13 or later. Software that bundles an older UnRAR.dll or UnRAR source code needs its own update from its maker.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on 12 August 2025, with a due date of 2 September 2025 for federal agencies. The catalog shows known ransomware campaign use. We opened no government source that names a ransomware group for this flaw, so this page names none.
Timeline
-
18 Jul 2025
ESET sees a malicious DLL inside a RAR archive with unusual paths. This is the first exploitation it reports.
-
24 Jul 2025
ESET reports the flaw to RARLAB. The fix lands the same day in WinRAR 7.13 beta 1, per ESET.
-
30 Jul 2025
RARLAB publishes WinRAR 7.13 final with the fix.
-
8 Aug 2025
The NVD record is published.
-
11 Aug 2025
ESET publishes its analysis and names the RomCom group as one of the actors, per its report.
-
12 Aug 2025
CISA adds the flaw to the KEV catalog, due 2 September 2025.
-
Apr 2026
Cisco Talos observes a RAR file that abuses the flaw in the Silent Lynx campaign against government bodies, the first exploit it saw in that group's delivery.
-
14 Oct 2026
Cisco Talos and Recorded Future publish their joint research on the group.
Who exploits it
What to do
-
Update to WinRAR 7.13 or later
Check the version on every Windows PC and install the current release from the maker. The Windows command line tools and UnRAR.dll need the same update.
-
Find hidden copies of old code
Other products may ship an old UnRAR.dll or UnRAR source. Ask the software makers and list those products in your asset inventory.
-
Watch the Startup folder
Alert on new files in each user's Startup folder, especially right after an archive was opened. ESET and Talos both saw the payload placed there.
-
Treat archive attachments with care
Scan RAR files from outside the company, and confirm unexpected archives from known senders another way. Recorded Future saw lures sent from compromised government email accounts.
-
If you suspect a hit
Check the Startup folder, %TEMP% for DLL files, and PowerShell that downloads from public sites. Keep the archive for analysis, then reset passwords used on the PC.
Questions
What is CVE-2025-8088?
A path traversal flaw in WinRAR for Windows. A crafted archive can write files outside the extraction folder, and that can run code.
Which WinRAR version fixes it?
WinRAR 7.13 final, released on 30 July 2025, per RARLAB. Install 7.13 or any later release.
Is CVE-2025-8088 exploited?
Yes. ESET saw attacks from 18 July 2025, and CISA added it to the KEV catalog on 12 August 2025 with known ransomware campaign use.
Who exploited it?
ESET attributes the first campaigns to the RomCom group, and says another actor followed. Cisco Talos attributes an April 2026 use against government bodies to UAT-6275, also called Silent Lynx.
Are Linux and Android affected?
No. RARLAB says the Unix versions of RAR and UnRAR and RAR for Android are not affected.
In our research
- Silent Lynx Threat group
Sources
- Known Exploited Vulnerabilities catalog (JSON feed, entry CVE-2025-8088) CISA
- CVE-2025-8088 record NIST NVD
- WinRAR release notes, version 7.13 RARLAB
- Security statement on WinRAR 7.13 final RARLAB
- Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability ESET Research
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations Cisco Talos
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.