Every CVE Search/ Get API key

CVE-2025-8088

Path traversal vulnerability in WinRAR

8.4 HighIn KEVPublic exploitFix available

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

94.0%Up 94.0 points since Aug 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.4

Path traversal vulnerability in WinRAR

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Record
CVE-2025-8088
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-35
Updated
2026-11-02
EUVDEUVD-2025-23983 8.4

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Record
EUVD-2025-23983
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-832g-3rcm-wcrf 8.4

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to...

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Record
GHSA-832g-3rcm-wcrf
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-35
Updated
2026-11-02
CISA KEV No score

RARLAB WinRAR Path Traversal Vulnerability

RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.

Record
CVE-2025-8088
Weakness
CWE-35
Updated
2026-11-02
NVD 8.4

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Record
CVE-2025-8088
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-35
Updated
2026-11-02
OSVALPINE-CVE-2025-8088 8.8

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Record
ALPINE-CVE-2025-8088
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 7 moreShow less
OSVopenSUSE-SU-2026:11583-1 No score

clamav-1.5.4-1.1 on GA media

These are all security issues fixed in the clamav-1.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11583-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21831-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
openSUSE-SU-2026:21831-1
Updated
2026-11-02
OSVSUSE-SU-2026:23706-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
SUSE-SU-2026:23706-1
Updated
2026-11-02
OSVSUSE-SU-2026:23727-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
SUSE-SU-2026:23727-1
Updated
2026-11-02
OSVSUSE-SU-2026:4179-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
SUSE-SU-2026:4179-1
Updated
2026-11-02
OSVSUSE-SU-2026:4180-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: ejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
SUSE-SU-2026:4180-1
Updated
2026-11-02
OSVSUSE-SU-2026:4208-1 No score

Security update for clamav

This update for clamav fixes the following issues:

  • CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
  • CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
  • CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
  • CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
  • CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
  • CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
  • CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
  • CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
  • CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

  • Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
  • FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
  • Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
  • Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
Record
SUSE-SU-2026:4208-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
clamav
Alpine:v3.24
 before 1.4.6-r0
1.4.6-r0
clamav
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 1.5.4-160000.1.1
1.5.4-160000.1.1
clamav
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 1.5.4-160000.1.1
1.5.4-160000.1.1
clamav
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-3.59.1
1.5.4-3.59.1
clamav
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.5.4-3.59.1
1.5.4-3.59.1
clamav
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 9 CVEs
 before 1.5.4-150600.18.31.1
1.5.4-150600.18.31.1
clamav
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-150600.18.31.1
1.5.4-150600.18.31.1
clamav
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 1.5.4-150600.18.31.1
1.5.4-150600.18.31.1
clamav
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
clamav
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 9 CVEs
 before 1.5.4-150400.13.11.1
1.5.4-150400.13.11.1
clamav
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.5.4-1.1
1.5.4-1.1
clamav
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 1.5.4-160000.1.1
1.5.4-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubjordan922/CVE-2025-80882025-08-10
PoC in GitHubtravisbgreen/cve-2025-80882025-08-11
PoC in GitHubknight0x07/WinRAR-CVE-2025-8088-PoC-RAR2025-08-12
PoC in GitHubsxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-2025-08-13
PoC in GitHubonlytoxi/CVE-2025-8088-Winrar-Tool2025-08-14
PoC in GitHub0xAbolfazl/CVE-2025-8088-WinRAR-PathTraversal-PoC2025-08-15
PoC in GitHubpentestfunctions/CVE-2025-8088-Multi-Document2025-08-16
PoC in GitHubpexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC2025-08-17
PoC in GitHubnhattanhh/CVE-2025-80882025-08-19
PoC in GitHubSyrins/CVE-2025-8088-Winrar-Tool-Gui2025-08-20
Show 15 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubghostn4444/CVE-2025-80882025-08-21
PoC in GitHubAdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal2025-08-26
PoC in GitHubpescada-dev/-CVE-2025-80882025-08-26
PoC in GitHubkitsuneshade/WinRAR-Exploit-Tool---Rust-Edition2025-08-27
PoC in GitHubpentestfunctions/best-CVE-2025-80882025-08-27
PoC in GitHubwalidpyh/CVE-2025-80882025-08-27
PoC in GitHubhexsecteam/CVE-2025-8088-Winrar-Tool2025-09-04
PoC in GitHubtechcorp/CVE-2025-8088-Exploit2025-09-14
PoC in GitHubShinkirou789/Cve-2025-8088-WinRar-vulnerability2025-09-17
PoC in GitHubhbesljx/CVE-2025-8088-EXP2025-09-18
PoC in GitHubpapcaii2004/CVE-2025-8088-WinRAR-builder2025-10-21
PoC in GitHubnuky-alt/CVE-2025-80882025-11-03
PoC in GitHubskander1337/winrar-exploit2025-11-07
PoC in GitHubxi0onamdev/WinRAR-CVE-2025-8088-Exploitation-Toolkit2025-11-29
PoC in GitHubilhamrzr/RAR-Anomaly-Inspector2026-01-11

Plus 5 more. The full list has every link.

History

History
RecordedChangedSources
affected
exploitation
affected, aliases, referencesOSV
exploits, exploits_more
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8088 is a high vulnerability (CVSS 8.4) in Rarlab Winrar, published August 8, 2025. CISA lists it as known to be exploited, since August 12, 2025. EUVD reports exploitation since August 12, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.0%, the 99th percentile. Fixed in clamav 1.4.6-r0.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open