Path traversal in WinRAR - CVE-2025-8088
Published: August 9, 2025 / Updated: August 7, 2026
Vulnerability identifier: #VU113784
CSH Severity: Critical
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-8088
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences inside archives. A remote attacker can trick the victim into opening specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
Note, the vulnerability is being actively exploited in the wild.
Affected software
WinRAR
ClamAV
SABnzbd
ClamAV
SABnzbd
How to mitigate CVE-2025-8088
Install updates from vendor's website.
WinRAR - update to 7.13
ClamAV - addressed in versions 1.4.6, 1.5.4
SABnzbd - update to 4.5.3
ClamAV - addressed in versions 1.4.6, 1.5.4
SABnzbd - update to 4.5.3
Links to Public Exploits and PoC-codes
- Exploit #12139 - cve-2025-8088 (November 28, 2025)
- Exploit #12080 - CVE-2025-8088 (November 7, 2025)
- Exploit #12053 - CVE-2025-8088-Exploit (A proof-of-concept exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams (ADS) with path traversal, potentially l (October 31, 2025)
- Exploit #12011 - CVE-2025-8088-Winrar-Tool (October 8, 2025)
- Exploit #11967 - CVE-2025-8088 (September 17, 2025)
- Exploit #11966 - CVE-2025-8088 (September 17, 2025)
- Exploit #11898 - CVE-2025-8088 (August 29, 2025)
- Exploit #11890 - WinRAR-Exploit-Tool---Rust-Edition (August 29, 2025)
- Exploit #11875 - CVE-2025-8088-Multi-Document (August 22, 2025)
- Exploit #11874 - WinRAR-CVE-2025-8088-Path-Traversal-PoC (August 22, 2025)
- Exploit #11873 - CVE-2025-8088-Winrar-Tool (August 22, 2025)
- Exploit #11857 - CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit- (August 15, 2025)
- Exploit #11856 - WinRAR-CVE-2025-8088-PoC-RAR (August 15, 2025)