WinRAR Path Traversal Zero-Day (CVE-2025-8088) Under Active Exploitation: How to Protect Yourself
In July and August 2025 the makers of WinRAR released version 7.13 to patch a serious zero-day vulnerability known as CVE-2025-8088. The flaw is a directory traversal bug affecting the Windows version of WinRAR that can be exploited when a user extracts a specially crafted archive. Malicious archive files contain alternative data streams or manipulated paths that trick WinRAR into writing files outside the intended extraction directory, which can lead to arbitrary code execution and full system compromise. Researchers from ESET, including Anton Cherepanov, Peter Kosinar, and Peter Strycek, discovered the vulnerability and observed threat actors actively exploiting it in the wild. The vulnerability received a CVSS v3 score of 8.8, and Tenable notes that it allows attackers to execute code by crafting malicious archive files and has been exploited in the wild.
How Attackers Abuse CVE-2025-8088
Attackers craft RAR archives with specially named files and hidden data streams that include relative paths. When unsuspecting users extract these archives, WinRAR writes payloads outside the extraction folder—sometimes into sensitive directories like the Windows Startup folder. The payload may be a loader that contacts a command-and-control server and downloads additional malware. Groups such as Paper Werewolf and RomCom have reportedly leveraged CVE-2025-8088 along with a related bug, CVE-2025-6218, to deliver backdoors and credential stealers.
Because exploitation requires user interaction, attackers often rely on phishing emails with enticing subjects or decoy documents. Once executed, the malware can run with the current user’s privileges and embed itself persistently. In targeted campaigns against European and Canadian companies, attackers used the vulnerability to install a .NET loader and other malicious payloads.
Mitigation and Protection Steps
To protect against CVE-2025-8088, users should immediately update to WinRAR version 7.13 or later. Earlier versions (up to 7.12) are vulnerable. Additional mitigation steps include:
- Block or quarantine unsolicited archive files: Educate employees about the dangers of opening unexpected attachments. The attack chain relies on social engineering.
- Use antivirus and EDR solutions: Employ tools that can detect and block malicious RAR archives and monitor for files written outside user-controlled directories.
- Extract archives in a controlled environment: Use sandboxes or unprivileged containers to limit potential damage if a malicious file is extracted.
- Apply application whitelisting: Prevent unknown executables from running after extraction, especially in sensitive or high-security networks.
Terra System Labs’ Role in Archival Security
As part of our penetration testing and red-team services, Terra System Labs examines file-decompression workflows and identifies exploitable misconfigurations. We help organisations implement secure file-handling policies, patch management, and employee awareness programmes. Our security awareness training includes modules on phishing, malicious attachments, and software update best practices. We also perform vulnerability assessments to ensure that third-party software like WinRAR is consistently updated across your environment.
By staying informed about zero-day vulnerabilities and promptly applying vendor updates, you can significantly reduce your attack surface. Contact Terra System Labs for guidance on patching processes, secure file transfer practices, and resilience against archive-based exploits. Together, we can ensure that one careless click never turns into a full system compromise.
Recent Posts
