The maintainers of the WinRAR file archiving utility have launched an replace to deal with an actively exploited zero-day vulnerability.
Tracked as CVE-2025-8088 (CVSS rating: 8.8), the difficulty has been described as a case of path traversal affecting the Home windows model of the software that may very well be exploited to acquire arbitrary code execution by crafting malicious archive recordsdata.
“When extracting a file, earlier variations of WinRAR, Home windows variations of RAR, UnRAR, moveable UnRAR supply code and UnRAR.dll might be tricked into utilizing a path, outlined in a specifically crafted archive, as a substitute of a specified path,” WinRAR mentioned in an advisory.
Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for locating and reporting the security defect, which has been addressed in WinRAR model 7.13 launched on July 31, 2025.
It is at present not recognized how the vulnerability is being weaponized in real-world assaults, and by whom. In 2023, one other vulnerability affecting WinRAR (CVE-2023-38831, CVSS rating: 7.8) got here underneath heavy exploitation, together with as a zero-day, by a number of risk actors from China and Russia.
Russian cybersecurity vendor BI.ZONE, in a report printed final week, mentioned there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) could have leveraged CVE-2025-8088 alongside CVE-2025-6218, a listing traversal bug within the Home windows model of WinRAR that was patched in June 2025.
It is necessary to notice that prior to those assaults, a risk actor recognized as “zeroplayer” was noticed promoting on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language darkish internet discussion board Exploit.in for a price ticket of $80,000. It is suspected that the Paper Werewolf actors could have acquired it and used it for his or her assaults.
“In earlier variations of WinRAR, in addition to RAR, UnRAR, UnRAR.dll, and the moveable UnRAR supply code for Home windows, a specifically crafted archive containing arbitrary code may very well be used to control file paths throughout extraction,” WinRAR mentioned in an alert for CVE-2025-6218 on the time.
“Consumer interplay is required to use this vulnerability, which might trigger recordsdata to be written outdoors the meant listing. This flaw may very well be exploited to position recordsdata in delicate areas – such because the Home windows Startup folder – probably resulting in unintended code execution on the subsequent system login.”
The assaults, per BI.ZONE, focused Russian organizations in July 2025 through phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and sure CVE-2025-8088 to write down recordsdata outdoors the goal listing and obtain code execution, whereas a decoy doc is offered to the sufferer as a distraction.
“The vulnerability is said to the truth that when making a RAR archive, you possibly can embody a file with various information streams, the names of which include relative paths,” BI.ZONE mentioned. “These streams can include arbitrary payload. When unpacking such an archive or opening an connected file instantly from the archive, information from the choice streams is written to arbitrary directories on the disk, which is a listing traversal assault.”
“The vulnerability impacts WinRAR variations as much as and together with 7.12. Beginning with model 7.13, this vulnerability is not reproduced.”
One of many malicious payloads in query is a .NET loader that is designed to ship system info to an exterior server and obtain extra malware, together with an encrypted .NET meeting.
“Paper Werewolf makes use of the C# loader to get the sufferer’s laptop identify and ship it within the generated hyperlink to the server to get the payload,” the corporate added. “Paper Werewolf makes use of sockets within the reverse shell to speak with the management server.”
7-Zip Plugs Arbitrary File Write Bug
The disclosure comes as 7-Zip shipped patches for a security flaw (CVE-2025-55188, CVSS rating: 2.7) that may very well be abused for arbitrary file write because of the method the software handles symbolic hyperlinks throughout extraction, which can lead to code execution. The difficulty has been addressed in model 25.01.
In a potential assault state of affairs, a risk actor might leverage the flaw to realize unauthorized entry or code execution by tampering with delicate recordsdata, equivalent to by overwriting a person’s SSH keys or .bashrc file.
The assault primarily targets Unix methods, however may also be tailored for Home windows with extra conditions. “On Home windows, the 7-Zip extraction course of should have the aptitude to create symbolic hyperlinks (e.g., extract with Administrator privileges, Home windows is in Developer Mode, and so on.),” security researcher “lunbun” mentioned.
