CVE-2025-8088
Rarlab Winrar ≤ 7.13
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-8088 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Microsoft Windows. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A path traversal vulnerability tracked as CVE-2025-8088 affects the Windows version of WinRAR. The flaw, assigned CWE-35 and carrying a CVSS 4.0 score of 8.4, permits attackers to execute arbitrary code through specially crafted archive files. It was discovered by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček.
Attackers can exploit the issue by delivering malicious archives that abuse the path traversal condition, resulting in code execution on the victim system. The vulnerability has already been exploited in the wild by at least two groups, according to public reporting.
Official guidance appears in the WinRAR advisory at win-rar.com along with mitigation references that discuss software restriction policies and image file execution options. Additional technical write-ups from Vicarius outline detection and containment steps for affected environments. The EPSS score has remained steady at 0.1161 with no material upward movement after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23983
Vulnerability Data
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček…
more
from ESET.
- CWE(s)
- KEV Date Added
- 12 August 2025
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly neutralizes path sequences so the traversal cannot be introduced or exploited.
Enforces access authorizations on the resulting pathname, blocking traversal attempts from succeeding.
Enforces information flow rules that stop unauthorized directory escapes via crafted paths.
Least privilege reduces the impact of any successful traversal by limiting accessible resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that neutralize traversal sequences.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect path-traversal flaws before release.
Secure SDLC mandates input validation and path-handling controls that directly mitigate path traversal.
Application security requirements include rules for safe file-path construction and canonicalization.
Secure architecture principles require proper directory restrictions and input sanitization to prevent traversal.
Secure coding standards explicitly forbid unsafe path concatenation and mandate canonicalization routines.
Information access restriction limits file reachability but does not address the input-validation flaw itself.