Path traversal in WinRAR (CVE-2025-8088) — code execution from a crafted archive, on software that runs on personal machines rather than enterprise systems
The Windows version of RARLAB WinRAR contains a path traversal flaw. An attacker can execute arbitrary code by crafting malicious archive files. CISA added it to the KEV catalog on 2025-08-12 with a due date of 2025-09-02. Use in ransomware campaigns is recorded as known.
Key facts
- CVE IDCVE-2025-8088
- Affected (vendor / product)RARLAB WinRAR
- CWECWE-35
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2025-09-02 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is the Windows version of RARLAB WinRAR; CWE-35, path traversal.
- A maliciously crafted archive file can let an attacker execute arbitrary code.
- An archive carries information about where contents go; where that specification reaches outside the destination, files can be placed at will.
- Within a ledger lined with enterprise products, this is software used daily on personal machines, with an attack starting from someone opening a file.
- Added to KEV 2025-08-12 with a due date of 2025-09-02. Ransomware use is known; 352 of the 1,685 records this site holds as of 2026-08-31 are ransomware-known.
- Unlike enterprise products, tools an individual installed have no central management, so the work begins with finding who installed them.
1The extraction step becomes the route
A compressed archive carries information about where its contents should be placed, and the program extracting it writes files according to that specification. Path traversal arises when the specification can reach outside the intended destination. Being able to place a file where you choose — somewhere read at startup, somewhere executed automatically — leads to code execution. Opening something, an entirely ordinary action, functions as permission to write.
2A different position within the ledger
The KEV records this site holds are lined with enterprise products: firewalls, business systems, virtualization platforms, development infrastructure. This record falls outside that, being compression software used daily on personal machines. The starting point of an attack is likewise not an internet-facing server but a person opening a file that arrived.
Organizational asset management usually captures servers and business systems while leaving the tools installed on individual machines uncatalogued.
3No update mechanism on the organization side
Enterprise products usually come with centralized distribution and update machinery; tools an individual installed do not. It stays old until the person using it installs a new version themselves. Of the 1,685 records this site holds as of 2026-08-31, 352 are recorded as known to be used in ransomware campaigns, and this is one of them.
Where the entrance sits in a user own hands, the practice of fixing by a deadline has to begin from establishing who installed it in the first place.
Why it matters
Asset management is usually organized around servers and business systems, leaving auxiliary tools on individual machines easy to miss. Products without centralized distribution make the practice of fixing by a deadline hard to sustain at all. Where an attack starts from a user action, taking inventory of what is installed matters alongside technical controls.
FAQ
What is path traversal?
Is opening a file alone dangerous?
How should an organization approach it?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).