CVE-2025-8088: 
WinRAR vulnerability analysis and mitigation

CVE-2025-8088 is a path traversal vulnerability (CWE-35: Path Traversal: '.../...//') in the Windows version of WinRAR that allows attackers to execute arbitrary code by crafting malicious archive files. Discovered on July 18, 2025 by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček, the vulnerability was reported to WinRAR developers on July 24, 2025, and patched in WinRAR 7.13 released July 30, 2025. It affects all WinRAR versions prior to 7.13, as well as Windows versions of UnRAR.dll and the portable UnRAR source code. The vulnerability has a CVSS v3.1 base score of 8.8 (High) (ESET WeLiveSecurity, CISA KEV).

The vulnerability exploits Windows Alternate Data Streams (ADS) to achieve path traversal, classified as CWE-35 (Path Traversal: '.../...//') by NVD and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) by estimate. Attackers craft malicious RAR archives that appear to contain only benign files but embed hidden malicious files as ADSes with specially crafted paths using relative path elements (e.g., ..\). When a victim opens the archive in WinRAR, the application silently extracts the hidden malicious files to attacker-controlled locations such as %TEMP%, %LOCALAPPDATA%, and critically the Windows Startup folder — enabling persistence without user awareness. The exploit requires user interaction (opening the archive) but no privileges, and the attack vector is network-delivered via phishing. ESET's technical analysis confirmed that WinRAR 7.12 and earlier failed to properly sanitize ADS-based paths during extraction (ESET WeLiveSecurity, Ars Technica).

Successful exploitation allows an unauthenticated attacker to achieve arbitrary code execution with the privileges of the user who opens the malicious archive, with full confidentiality, integrity, and availability impact. The vulnerability enables persistent backdoor installation via the Windows Startup folder, meaning malware executes automatically on every user login. Observed payloads include the RomCom backdoor (SnipBot variant, RustyClaw, MeltingClaw, Mythic agent), GammaDrop, GammaLoad, GammaWorm, GammaSteel, GIFTEDCROOK, SalatStealer, Poison Ivy, STOCKSTAY, XWorm, AsyncRAT, and others — enabling credential theft, lateral movement, data exfiltration, and long-term espionage (ESET WeLiveSecurity, Google Mandiant).

1. Reconnaissance: Identify targets using WinRAR on Windows (approximately 500 million users globally). Conduct spearphishing reconnaissance to identify target organization domain names for targeted attacks.
2. Craft malicious archive: Create a RAR archive that appears to contain only a benign file (e.g., a CV document). Embed malicious files as Windows Alternate Data Streams (ADSes) with specially crafted path traversal sequences (e.g., ..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.lnk) to target the Windows Startup folder and %TEMP%/%LOCALAPPDATA%.
3. Deliver via phishing: Send the malicious RAR archive as an email attachment, typically disguised as a job application, CV, or official document. RomCom used subjects like 'Experienced Web3 Developer – CV Attached' targeting financial, manufacturing, defense, and logistics sectors.
4. Victim opens archive: When the victim opens the archive in WinRAR (versions prior to 7.13), WinRAR silently extracts the hidden ADS-embedded malicious files to the attacker-specified paths, including the Windows Startup folder — without displaying the malicious files in the UI (only error messages for invalid paths appear).
5. Persistence established: A malicious LNK file placed in the Startup folder executes on next user login, loading a malicious DLL (e.g., via COM hijacking of {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}) or running a malicious executable.
6. Payload execution: The loader decrypts and executes the final payload (e.g., SnipBot, RustyClaw/MeltingClaw, Mythic agent, GammaDrop/GammaLoad). Anti-analysis checks may verify domain name or RecentDocs count before proceeding.
7. C2 communication and post-exploitation: The backdoor establishes encrypted HTTPS C2 communication, enabling credential theft, lateral movement via SSH tunnels, screen capture, file exfiltration, and deployment of additional modules (ESET WeLiveSecurity, Ars Technica).

• File System:

  • Unexpected files in %TEMP% (e.g., msedge.dll) or %LOCALAPPDATA% (e.g., ApbxHelper.exe, Complaint.exe) dropped during RAR extraction
  • Malicious LNK files in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ (e.g., Updater.lnk, Display Settings.lnk, Settings.lnk)
  • RAR archives with ADS-embedded files: Eli_Rosenfeld_CV2 - Copy (10).rar, cv_submission.rar, JobDocs_July2025.rar, Recruitment_Dossier_July_2025.rar, Adverse_Effect_Medical_Records_2025.rar
  • SHA-1 hashes: 371A5B8BA86FBCAB80D4E0087D2AA0D8FFDDC70B, D43F49E6A586658B5422EDC647075FFD405D6741, F77DBA76010A9988C9CEB8E420C96AEBC071B889, AB79081D0E26EA278D3D45DA247335A545D0512E (RustyClaw), 1AEA26A2E2A7711F89D06165E676E11769E2FD68 (SnipBot variant)

• Registry:

  • New registry value at HKCU\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 pointing to %TEMP%\msedge.dll (COM hijacking for persistence)

• Network:

  • C2 connections to: srlaptop[.]com (194.36.209[.]127), campanole[.]com (185.173.235[.]134), melamorri[.]com (85.158.108[.]62), gohazeldale[.]com (162.19.175[.]44)
  • Outbound HTTPS connections from WinRAR process or spawned child processes to unknown domains

• Process:

  • Unusual child processes spawned by WinRAR (e.g., msedge.exe loading unexpected DLLs, wmic.exe as child process)
  • ApbxHelper.exe (modified PuTTY CAC) or Complaint.exe executing from %LOCALAPPDATA%
  • Processes checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\ registry key

• Logs:

  • WinRAR extraction warnings about invalid/unusual paths in archive contents
  • YARA rule available: exploit_rar_archive_with_path_traversal_aug25.yar (Neo23x0/signature-base)
  • Sigma rule: file_event_win_winrar_file_creation_in_startup_folder (SigmaHQ)

(ESET WeLiveSecurity, CISA KEV)

The primary remediation is to update WinRAR to version 7.13 or later immediately, as this version patches CVE-2025-8088 along with all other known vulnerabilities (WinRAR Advisory). Note that WinRAR does not auto-update, so users must manually download and install the patch. Software solutions relying on Windows versions of UnRAR.dll or the portable UnRAR source code must also update their dependencies. As a workaround, exercise extreme caution when opening RAR archives from untrusted or unexpected sources, and consider restricting user permissions to limit the impact of successful exploitation. CISA's BOD 22-01 requires federal agencies to remediate this vulnerability by September 2, 2025 (CISA KEV).

ESET publicly disclosed the vulnerability on August 11, 2025, crediting their researchers and praising WinRAR for releasing a patch within one day of notification (ESET WeLiveSecurity). Russian security firm BI.ZONE independently discovered exploitation by Paper Werewolf (GOFFEE) and speculated the group may have procured the vulnerability from a dark web forum (Ars Technica). Google/Mandiant issued a major warning in January 2026 noting that six months after patching, the vulnerability remained widely exploited by both nation-state actors and cybercriminals, highlighting the persistent challenge of WinRAR's lack of auto-update functionality (Google Mandiant). Check Point Research documented the China-linked Amaranth Dragon (linked to APT41) weaponizing the flaw within 10 days of public disclosure for Southeast Asian government espionage (Check Point Research). The vulnerability received extensive media coverage from BleepingComputer, The Register, Ars Technica, The Hacker News, and PCMag, with widespread community discussion on Reddit and security forums emphasizing the danger of WinRAR's manual update model.