CVE-2025-8088
Published: 08 August 2025
Summary
CVE-2025-8088 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Microsoft Windows. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 7.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the WinRAR path traversal vulnerability to directly prevent arbitrary code execution from malicious archives.
Deploys malicious code protection mechanisms to scan and block crafted RAR archives exploiting the path traversal vulnerability at entry points.
Prohibits or controls user installation of vulnerable third-party software like WinRAR, preventing deployment of exploitable applications.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables arbitrary code execution via crafted malicious WinRAR archives requiring user interaction to open, directly facilitating client-side exploitation (T1203) and malicious file execution (T1204.002).
NVD Description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček…
more
from ESET.
Deeper analysisAI
CVE-2025-8088 is a path traversal vulnerability (CWE-35) affecting the Windows version of WinRAR, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Published on 2025-08-08, it enables attackers to execute arbitrary code by crafting malicious archive files processed by the software.
Remote attackers without privileges can exploit the vulnerability by distributing malicious archives, requiring user interaction such as opening the file in WinRAR on a Windows system. Successful exploitation grants high-impact arbitrary code execution, compromising confidentiality, integrity, and availability.
Advisories from WinRAR and security analyses, including those from Ars Technica and Vicarius, detail detection and mitigation strategies; Vicarius specifically covers approaches using Software Restriction Policies (SRP) and Image File Execution Options (IFEO).
The vulnerability was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET and has been exploited in the wild, including for weeks by two groups as reported in related coverage.
Details
- CWE(s)
- KEV Date Added
- 12 August 2025