CVE-2025-8088: Critical WinRAR Path Traversal — Zero-Day RCE
A critical path traversal vulnerability in WinRAR allows attackers to execute arbitrary code by exploiting NTFS Alternate Data Streams. Here is everything you need to know.
8.8
CVSS Score
HIGH SEVERITY
Attack Vector: Local
Exploit Maturity: Weaponized
Patch Available: Yes
Active Exploitation: Confirmed
TL;DR — Update Now!
- CVE-2025-8088 is a critical Arbitrary File Write vulnerability in WinRAR
- Attackers use NTFS Alternate Data Streams to plant malware in the Windows Startup folder
- Affected: WinRAR versions prior to 7.13
- Solution: Update WinRAR to version 7.13 immediately
What is CVE-2025-8088?
CVE-2025-8088 is a high-severity path traversal vulnerability affecting the file extraction process in WinRAR. The issue arises from the mishandling of NTFS Alternate Data Streams (ADS) within ZIP archives.
This flaw allows an attacker to craft a malicious archive that, when unpacked by an unsuspecting user, extracts files to unintended locations—specifically the Windows Startup folder—without the user's knowledge. This leads to Remote Code Execution (RCE) upon the next system reboot.
Attack Flow Visualization
- Victim downloads a malicious ZIP archive
- Victim extracts the archive using a vulnerable WinRAR version
- Malicious file exploits NTFS ADS to bypass destination checks
- Executable payload is written silently to the Startup folder
- Malware executes automatically when the victim restarts the PC
How Does It Work?
The vulnerability exploits how WinRAR processes NTFS Alternate Data Streams. ADS is a feature in Windows that allows files to contain additional metadata. Attackers can create a specially crafted archive where a file entry includes a colon (:) to reference an ADS.
By manipulating this, they can trick WinRAR into writing the payload outside the intended extraction folder. A common exploit scenario involves writing a script or executable into C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. Since the file is hidden in an ADS or created with deceptive naming, the user sees no suspicious files in the extraction folder, but the machine is compromised.
Impact & Severity
CVSS Score: 8.8 (High)
This vulnerability has been actively exploited in the wild by threat actors, including the RomCom group and various APTs. The impact includes:
• Remote Code Execution: Attackers gain control over the victim's machine.
• Persistence: Malware survives reboots by residing in the Startup folder.
• Data Theft: Once inside, attackers can exfiltrate sensitive documents and credentials.
Affected Versions
This vulnerability affects WinRAR:
• All versions prior to 7.13
How to Fix It
The only effective remediation is to update the software.
Option 1: Update WinRAR (Mandatory)
Download and install the latest version (7.13 or newer) from the official WinRAR website (rarlab.com). The patch improves the validation of file names and NTFS streams during extraction.
Option 2: Mitigation
If you cannot update immediately, avoid extracting archives from untrusted sources. Security administrators can also block the execution of files originating from standard archive extraction paths using Endpoint Detection and Response (EDR) rules.
How to Verify Vulnerability
If your organization uses older versions of WinRAR, you are exposed to zero-day attacks. TEPTEZ can automatically scan your endpoints to identify vulnerable software versions like CVE-2025-8088. Our platform provides real-time visibility into your exposure and actionable remediation steps.
References
How to Detect Exploitation Attempts
- [01]Unexpected files appearing in the Windows Startup folder
- [02]Process execution chains starting from the Startup directory
- [03]WinRAR extracting files with unusual NTFS stream attributes
- [04]Presence of files with suspicious ADS markers in file system logs
Protect Your Systems with TEPTEZ
Don't wait for the next zero-day. TEPTEZ continuously monitors your endpoints for CVE vulnerabilities, misconfigurations, and security threats.
Start Free Security Scan