Vulnerability report

Exploited in the wild Confirmed confidence In CISA KEV

CVE-2025-8088

Path traversal vulnerability in WinRAR

Win.rar / WinRAR · 0 to <= 7.12

Watch CVE-2025-8088 Browse KEV feed
Severity
CVSS 8.4 · High
Confidence
Confirmed
Exploit status
Exploited in the wild
EPSS
94.3%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2025-8088 is an unauthenticated Path traversal vulnerability in WinRAR. A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious...

Is it exploited?

Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Win.rar / WinRAR 0 to <= 7.12.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Path traversal vulnerability in WinRAR

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files.

This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

win.rar GmbH Affected
WinRAR
Through 7.12
Published
08 Aug 2025
Exploitation Reported
01 Jun 2026
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
—

Tags

cisa windows

CVE References

  • CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2025-8088
  • win-rar.com/singlenewsview.html win-rar.com · CVE Record https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%...

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CVE

Recorded 01 Jun 2026

A trusted third party reported exploitation.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
CVE First 2026-06-01 10:38 UTC
CISA 2026-06-02 14:06 UTC
The Hacker News 2026-06-09 13:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

8.4 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

94.3%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Path Traversal: '.../...//' CWE-35

Recent mention · Google Threat Intelligence

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as...

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard,...

Read full advisory

All CVSS Scores

CVSS v4.0 8.4 High

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All Mentions

Recent mention · Google Threat Intelligence

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as...

Google Threat Intelligence · 25 Jun 2026

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing cyber espionage, this backdoor shares significant code and functional overlaps with KAZUAR, a...

Recent mention · Daily CyberSecurity

Old WinRAR Flaw Still Fuels Attacks on Ukraine in 2026

Daily CyberSecurity · 15 Jun 2026

A Patched Flaw That Refuses to Die Nearly a year after a fix shipped, the WinRAR vulnerability Russia-aligned The post Old WinRAR Flaw Still Fuels Attacks on Ukraine in 2026 appeared first on Daily CyberSecurity. Related posts: Beyond the Inbox: How a Cyber-Espionage Group Is Exploiting Two WinRAR Vulnerabilities The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies Anatomy of an Attack: New Report Exposes Ukrainian Networks Fueling Global Brute-Force Campaigns

Recent mention · Dark Reading

Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs

Dark Reading · 09 Jun 2026

Two separate campaigns target CVE-2025-8088, fixed last July, to conduct data theft and cyberespionage against military and government targets in Ukraine.

Recent mention · The Hacker News

WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

The Hacker News · 09 Jun 2026

Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year after patches for the vulnerability were released. The activity has been attributed by Trend Micro to Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (aka UAC-0226). It involves the exploitation of CVE-2025-8088, a path traversal flaw that allows an

Recent mention · The Hacker News

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

The Hacker News · 02 Jun 2026

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

Timeline

From disclosure to observed exploitation

  1. 13:20 UTC

    KEV confirmed by The Hacker News

    Exploitation attested by an external source

  2. 14:06 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  3. 10:38 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party attested exploitation

  4. 11:11 UTC

    CVE published

    Vulnerability disclosed publicly

  5. 15:35 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2025-8088

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2025-8088",
  "confidence": "Confirmed",
  "cvss_score": 8.4,
  "cvss_estimated": false,
  "epss_score": 0.9426,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}