The maintainers of the WinRAR file archiving utility have launched an replace to handle an actively exploited zero-day vulnerability.
Tracked as CVE-2025-8088 (CVSS rating: 8.8), the difficulty has been described as a case of path traversal affecting the Home windows model of the instrument that might be exploited to acquire arbitrary code execution by crafting malicious archive information.
“When extracting a file, earlier variations of WinRAR, Home windows variations of RAR, UnRAR, transportable UnRAR supply code and UnRAR.dll will be tricked into utilizing a path, outlined in a specifically crafted archive, as an alternative of a specified path,” WinRAR mentioned in an advisory.
Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for locating and reporting the safety defect, which has been addressed in WinRAR model 7.13 launched on July 31, 2025.
It is at the moment not recognized how the vulnerability is being weaponized in real-world assaults, and by whom. In 2023, one other vulnerability affecting WinRAR (CVE-2023-38831, CVSS rating: 7.8) got here beneath heavy exploitation, together with as a zero-day, by a number of menace actors from China and Russia.
Russian cybersecurity vendor BI.ZONE, in a report printed final week, mentioned there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) could have leveraged CVE-2025-8088 alongside CVE-2025-6218, a listing traversal bug within the Home windows model of WinRAR that was patched in June 2025.
It is vital to notice that prior to those assaults, a menace actor recognized as “zeroplayer” was noticed promoting on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language darkish net discussion board Exploit.in for a price ticket of $80,000. It is suspected that the Paper Werewolf actors could have acquired it and used it for his or her assaults.
“In earlier variations of WinRAR, in addition to RAR, UnRAR, UnRAR.dll, and the transportable UnRAR supply code for Home windows, a specifically crafted archive containing arbitrary code might be used to govern file paths throughout extraction,” WinRAR mentioned in an alert for CVE-2025-6218 on the time.
“Person interplay is required to use this vulnerability, which might trigger information to be written exterior the meant listing. This flaw might be exploited to position information in delicate areas – such because the Home windows Startup folder – doubtlessly resulting in unintended code execution on the subsequent system login.”
The assaults, per BI.ZONE, focused Russian organizations in July 2025 by way of phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and sure CVE-2025-8088 to put in writing information exterior the goal listing and obtain code execution, whereas a decoy doc is offered to the sufferer as a distraction.
“The vulnerability is said to the truth that when making a RAR archive, you’ll be able to embody a file with different knowledge streams, the names of which include relative paths,” BI.ZONE mentioned. “These streams can include arbitrary payload. When unpacking such an archive or opening an hooked up file straight from the archive, knowledge from the choice streams is written to arbitrary directories on the disk, which is a listing traversal assault.”
“The vulnerability impacts WinRAR variations as much as and together with 7.12. Beginning with model 7.13, this vulnerability is not reproduced.”
One of many malicious payloads in query is a .NET loader that is designed to ship system data to an exterior server and obtain further malware, together with an encrypted .NET meeting.
“Paper Werewolf makes use of the C# loader to get the sufferer’s laptop identify and ship it within the generated hyperlink to the server to get the payload,” the corporate added. “Paper Werewolf makes use of sockets within the reverse shell to speak with the management server.”
