The maintainers of the WinRAR file archiving utility have launched an replace to deal with an actively exploited zero-day vulnerability.
Tracked as CVE-2025-8088 (CVSS rating: 8.8), the difficulty has been described as a case of path traversal affecting the Home windows model of the software that may very well be exploited to acquire arbitrary code execution by crafting malicious archive information.
“When extracting a file, earlier variations of WinRAR, Home windows variations of RAR, UnRAR, moveable UnRAR supply code and UnRAR.dll might be tricked into utilizing a path, outlined in a specifically crafted archive, as an alternative of a specified path,” WinRAR stated in an advisory.
Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for locating and reporting the safety defect, which has been addressed in WinRAR model 7.13 launched on July 31, 2025.
It is at present not identified how the vulnerability is being weaponized in real-world assaults, and by whom. In 2023, one other vulnerability affecting WinRAR (CVE-2023-38831, CVSS rating: 7.8) got here underneath heavy exploitation, together with as a zero-day, by a number of menace actors from China and Russia.
Russian cybersecurity vendor BI.ZONE, in a report printed final week, stated there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) could have leveraged CVE-2025-8088 alongside CVE-2025-6218, a listing traversal bug within the Home windows model of WinRAR that was patched in June 2025.
It is essential to notice that prior to those assaults, a menace actor recognized as “zeroplayer” was noticed promoting on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language darkish net discussion board Exploit.in for a price ticket of $80,000. It is suspected that the Paper Werewolf actors could have acquired it and used it for his or her assaults.
“In earlier variations of WinRAR, in addition to RAR, UnRAR, UnRAR.dll, and the moveable UnRAR supply code for Home windows, a specifically crafted archive containing arbitrary code may very well be used to govern file paths throughout extraction,” WinRAR stated in an alert for CVE-2025-6218 on the time.
“Consumer interplay is required to take advantage of this vulnerability, which may trigger information to be written outdoors the supposed listing. This flaw may very well be exploited to put information in delicate areas – such because the Home windows Startup folder – doubtlessly resulting in unintended code execution on the subsequent system login.”
The assaults, per BI.ZONE, focused Russian organizations in July 2025 through phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and certain CVE-2025-8088 to write down information outdoors the goal listing and obtain code execution, whereas a decoy doc is offered to the sufferer as a distraction.
“The vulnerability is expounded to the truth that when making a RAR archive, you possibly can embrace a file with various knowledge streams, the names of which include relative paths,” BI.ZONE stated. “These streams can include arbitrary payload. When unpacking such an archive or opening an connected file straight from the archive, knowledge from the choice streams is written to arbitrary directories on the disk, which is a listing traversal assault.”
“The vulnerability impacts WinRAR variations as much as and together with 7.12. Beginning with model 7.13, this vulnerability is now not reproduced.”
One of many malicious payloads in query is a .NET loader that is designed to ship system data to an exterior server and obtain extra malware, together with an encrypted .NET meeting.
“Paper Werewolf makes use of the C# loader to get the sufferer’s laptop identify and ship it within the generated hyperlink to the server to get the payload,” the corporate added. “Paper Werewolf makes use of sockets within the reverse shell to speak with the management server.”
7-Zip Plugs Arbitrary File Write Bug
The disclosure comes as 7-Zip shipped patches for a safety flaw (CVE-2025-55188, CVSS rating: 2.7) that may very well be abused for arbitrary file write as a result of method the software handles symbolic hyperlinks throughout extraction, which can lead to code execution. The difficulty has been addressed in model 25.01.
In a potential assault situation, a menace actor may leverage the flaw to realize unauthorized entry or code execution by tampering with delicate information, comparable to by overwriting a person’s SSH keys or .bashrc file.
The assault primarily targets Unix programs, however can be tailored for Home windows with extra stipulations. “On Home windows, the 7-Zip extraction course of should have the aptitude to create symbolic hyperlinks (e.g., extract with Administrator privileges, Home windows is in Developer Mode, and many others.),” safety researcher “lunbun” stated.
