A crafted archive can write files outside the folder the user picked, and that can lead to code running on the PC. It was exploited before the fix came out, and CISA lists it as exploited, with known ransomware campaign use.
What it allows
A person who opens or extracts a crafted RAR archive can have files written to places they did not choose. ESET found that the attack used NTFS alternate data streams. Hidden files, a DLL and a shortcut for the Windows Startup folder, were written in silence, and the shortcut made the payload run at the next sign-in. Extra streams with dummy data and invalid paths triggered WinRAR warnings, so the malicious DLL and shortcut paths were easy to miss.
Attacks were reported in two waves. ESET attributed the first spear-phishing campaigns, from 18 to 21 July 2025, to the RomCom group, and said a second actor followed a few days later. In April 2026 Cisco Talos saw a RAR file with this flaw place the PickleShell reverse shell in the Startup folder, in a campaign against government bodies that it attributes to the group UAT-6275, known as Silent Lynx.
ESET reported in November 2026 that the Gorbag actor uses this flaw against Ukrainian bodies; see how Gorbag delivers BeautyStealer through WinRAR archives.
Who is affected
RARLAB says previous versions of WinRAR, the Windows versions of RAR, UnRAR, the portable UnRAR source code and UnRAR.dll can be tricked into using a path from a crafted archive. The Unix versions of RAR and UnRAR, their source code and library, and RAR for Android are not affected. NVD lists WinRAR before 7.13, and also dtSearch before 2023.01.
The fix is WinRAR 7.13 final, released on 30 July 2025. It is a different bug from the traversal flaw fixed in 7.12. Update to 7.13 or later. Software that bundles an older UnRAR.dll or UnRAR source code needs its own update from its maker.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on 12 August 2025, with a due date of 2 September 2025 for federal agencies. The catalog shows known ransomware campaign use.
MDaemon Email Server 22.0.0 through 26.0.3 (and older) with the MDaemon AntiVirus feature ships an affected ClamAV UnRAR library, per MDaemon; fixed in 26.0.4. Our post on MDaemon servers backdoored through ClamAV has the steps for administrators.
Timeline
- 18 Jul 2025
ESET sees a malicious DLL inside a RAR archive with unusual paths. This is the first exploitation it reports.
- 24 Jul 2025
ESET reports the flaw to RARLAB. The fix lands the same day in WinRAR 7.13 beta 1, per ESET.
- 30 Jul 2025
RARLAB publishes WinRAR 7.13 final with the fix.
- 8 Aug 2025
The NVD record is published.
- 11 Aug 2025
ESET publishes its analysis and names the RomCom group as one of the actors, per its report.
- 12 Aug 2025
CISA adds the flaw to the KEV catalog, due 2 September 2025.
- Apr 2026
Cisco Talos observes a RAR file that abuses the flaw in the Silent Lynx campaign against government bodies, the first exploit it saw in that group's delivery.
- 1 Sep 2026
MDaemon updates critical notice MD090126: the ClamAV library in MDaemon AntiVirus is open to this flaw; fixed in MDaemon 26.0.4.
- 14 Oct 2026
Cisco Talos and Recorded Future publish their joint research on the group.
- 28 Oct 2026
ESET reports a campaign in Ukraine that exploited the flaw through MDaemon's ClamAV scanner with no user interaction, deploying HELLAGE and HELLTAG. ESET calls the attackers Russia-aligned and ties the campaign to no known group.
Who exploits it
What to do
-
Update to WinRAR 7.13 or later
Check the version on every Windows PC and install the current release from the maker. The Windows command line tools and UnRAR.dll need the same update.
-
Find hidden copies of old code
Other products may ship an old UnRAR.dll or UnRAR source. Ask the software makers and list those products in your asset inventory.
-
Watch the Startup folder
Alert on new files in each user's Startup folder, especially right after an archive was opened. ESET and Talos both saw the payload placed there.
-
Treat archive attachments with care
Scan RAR files from outside the company, and confirm unexpected archives from known senders another way. Recorded Future saw lures sent from compromised government email accounts.
-
If you suspect a hit
Check the Startup folder, %TEMP% for DLL files, and PowerShell that downloads from public sites. Keep the archive for analysis, then reset passwords used on the PC.
Frequently Asked Questions
What is CVE-2025-8088?
A path traversal flaw in WinRAR for Windows. A crafted archive can write files outside the extraction folder, and that can run code.
Which WinRAR version fixes it?
WinRAR 7.13 final, released on 30 July 2025, per RARLAB. Install 7.13 or any later release.
Is CVE-2025-8088 exploited?
Yes. ESET saw attacks from 18 July 2025, and CISA added it to the KEV catalog on 12 August 2025 with known ransomware campaign use.
Who exploited it?
ESET attributes the first campaigns to the RomCom group, and says another actor followed. Cisco Talos attributes an April 2026 use against government bodies to UAT-6275, also called Silent Lynx. ESET also reports a 2026 campaign in Ukraine that exploited the flaw through MDaemon's ClamAV scanner; it calls the attackers Russia-aligned but ties the campaign to no known group.
Are Linux and Android affected?
No. RARLAB says the Unix versions of RAR and UnRAR and RAR for Android are not affected.
Sources
- Known Exploited Vulnerabilities catalog (entry CVE-2025-8088)CISA
- CVE-2025-8088 recordNIST NVD
- WinRAR release notes, version 7.13RARLAB
- Security statement on WinRAR 7.13 finalRARLAB
- Update WinRAR tools now: RomCom and others exploiting zero-day vulnerabilityESET Research
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationsCisco Talos
- Critical updates notice MD090126MDaemon Technologies
- ESET APT Activity Report Q2 2026 to Q3 2026ESET Research
