The maintainers of the WinRAR file archiving utility have launched an replace to deal with an actively exploited zero-day vulnerability.
Tracked as CVE-2025-8088 (CVSS rating: 8.8), the difficulty has been described as a case of path traversal affecting the Home windows model of the device that might be exploited to acquire arbitrary code execution by crafting malicious archive recordsdata.
“When extracting a file, earlier variations of WinRAR, Home windows variations of RAR, UnRAR, transportable UnRAR supply code and UnRAR.dll may be tricked into utilizing a path, outlined in a specifically crafted archive, as a substitute of a specified path,” WinRAR stated in an advisory.
Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for locating and reporting the safety defect, which has been addressed in WinRAR model 7.13 launched on July 31, 2025.
It is at the moment not identified how the vulnerability is being weaponized in real-world assaults, and by whom. In 2023, one other vulnerability affecting WinRAR (CVE-2023-38831, CVSS rating: 7.8) got here beneath heavy exploitation, together with as a zero-day, by a number of risk actors from China and Russia.
Russian cybersecurity vendor BI.ZONE, in a report printed final week, stated there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) could have leveraged CVE-2025-8088 alongside CVE-2025-6218, a listing traversal bug within the Home windows model of WinRAR that was patched in June 2025.
It is essential to notice that prior to those assaults, a risk actor recognized as “zeroplayer” was noticed promoting on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language darkish internet discussion board Exploit.in for a price ticket of $80,000. It is suspected that the Paper Werewolf actors could have acquired it and used it for his or her assaults.
“In earlier variations of WinRAR, in addition to RAR, UnRAR, UnRAR.dll, and the transportable UnRAR supply code for Home windows, a specifically crafted archive containing arbitrary code might be used to control file paths throughout extraction,” WinRAR stated in an alert for CVE-2025-6218 on the time.
“Person interplay is required to use this vulnerability, which may trigger recordsdata to be written exterior the meant listing. This flaw might be exploited to position recordsdata in delicate areas – such because the Home windows Startup folder – doubtlessly resulting in unintended code execution on the subsequent system login.”
The assaults, per BI.ZONE, focused Russian organizations in July 2025 by way of phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and certain CVE-2025-8088 to jot down recordsdata exterior the goal listing and obtain code execution, whereas a decoy doc is introduced to the sufferer as a distraction.
“The vulnerability is said to the truth that when making a RAR archive, you may embody a file with various knowledge streams, the names of which include relative paths,” BI.ZONE stated. “These streams can include arbitrary payload. When unpacking such an archive or opening an hooked up file instantly from the archive, knowledge from the choice streams is written to arbitrary directories on the disk, which is a listing traversal assault.”
“The vulnerability impacts WinRAR variations as much as and together with 7.12. Beginning with model 7.13, this vulnerability is now not reproduced.”
One of many malicious payloads in query is a .NET loader that is designed to ship system data to an exterior server and obtain further malware, together with an encrypted .NET meeting.
“Paper Werewolf makes use of the C# loader to get the sufferer’s pc title and ship it within the generated hyperlink to the server to get the payload,” the corporate added. “Paper Werewolf makes use of sockets within the reverse shell to speak with the management server.”
7-Zip Plugs Arbitrary File Write Bug
The disclosure comes as 7-Zip shipped patches for a safety flaw (CVE-2025-55188, CVSS rating: 2.7) that might be abused for arbitrary file write as a result of method the device handles symbolic hyperlinks throughout extraction, which can lead to code execution. The difficulty has been addressed in model 25.01.
In a potential assault state of affairs, a risk actor may leverage the flaw to attain unauthorized entry or code execution by tampering with delicate recordsdata, reminiscent of by overwriting a person’s SSH keys or .bashrc file.
The assault primarily targets Unix methods, however can be tailored for Home windows with further conditions. “On Home windows, the 7-Zip extraction course of will need to have the aptitude to create symbolic hyperlinks (e.g., extract with Administrator privileges, Home windows is in Developer Mode, and so on.),” safety researcher “lunbun” stated.
