WinRAR's invisible file: how CVE-2025-8088 hid a zero-day inside an NTFS data stream
A path-traversal flaw that two threat groups were exploiting weeks before anyone had a name for it — and why your "no public exploit" dashboard was lying to you.
For about six weeks in the summer of 2025, opening the wrong .rar file was enough to hand a Russia-aligned espionage crew a foothold on your machine — and WinRAR's own "this file has a suspicious path" warning never fired. CVE-2025-8088 is a path-traversal bug, but the interesting part is how it was hidden: the malicious payload didn't live in a file at all. It lived in an NTFS Alternate Data Stream, invisible in the archive listing, quietly writing itself outside the folder you thought you were extracting to.
Scores as of 2026-07-23live record →
What the bug actually is
WinRAR (the Windows build specifically) mishandled paths during extraction, so a crafted archive could write a file above the directory the user chose — classic directory traversal, catalogued as CWE-35 (Path Traversal: '.../...//'). On its own that's an old class of bug. What made this one a usable zero-day was the delivery trick attackers paired it with.
| Property | Value |
|---|---|
| CVE | CVE-2025-8088 |
| Weakness | CWE-35 — Path Traversal |
| CVSS 3.1 | 8.8 / HIGH — AV:N / AC:L / PR:N / UI:R / S:U / C:H / I:H / A:H |
| Affected | WinRAR (Windows) ≤ 7.12, plus Windows UnRAR.dll, the CLI tools, and the portable UnRAR source |
| Fixed in | WinRAR 7.13 |
| Discovered by | Anton Cherepanov, Peter Košinár & Peter Strýček (ESET) |
| Status | Exploited in the wild · CISA KEV |
The deception: why WinRAR's own warnings didn't help
According to ESET, the malicious archives were built to look empty. WinRAR's file list showed a single, harmless-looking document. The dangerous payloads were tucked into NTFS Alternate Data Streams (ADSes) attached to that file — and the attackers padded the archive with decoy ADSes carrying dummy data and deliberately invalid paths. The genuinely malicious traversal paths only became visible if you scrolled down in the WinRAR UI, drowned out by noise most users would never see. On extraction, a malicious DLL was dropped into %TEMP% and a .lnk file was planted in the Windows Startup folder for persistence.
CVE-2025-8088 exploitation chain
- Spearphish: CV / job-application email with a RAR attachment
- Victim opens the archive in WinRAR ≤ 7.12
- UI shows one harmless file; malicious ADS paths hidden below the scroll
- ADS path traversal (CWE-35) escapes the extraction directory
- Malicious DLL → %TEMP%
- LNK → Startup folder (persistence)
- On login: payload runs — Mythic / SnipBot / MeltingClaw
Who was using it
This wasn't a one-crew affair. ESET attributes the original campaign to RomCom (tracked elsewhere as Storm-0978, Tropical Scorpius, UNC2596), and Russian firm BI.ZONE reported a second, independent actor picking up the same bug days later.
Two crews, one zero-day
- Russia-aligned espionage group
- At least their third caught zero-day (see below)
- Payloads: Mythic agent (COM hijack), a SnipBot variant, and RustyClaw → MeltingClaw
- Lure: CV / job-application spearphishing
- Targets: financial, manufacturing, defense & logistics across Europe and Canada
- Reported by Russian security firm BI.ZONE
- Began exploiting CVE-2025-8088 a few days after RomCom
- Same NTFS-ADS path-traversal primitive, separately weaponized
The "third zero-day" line matters, because it tells you how much attention this actor pays to widely-installed client software. RomCom has been caught burning in-the-wild zero-days before:
Scores as of 2026-07-23live record →
Disclosure timeline
From in-the-wild to patched
- A separate WinRAR path-traversal bug is disclosedCVE-2025-6218, patched weeks earlier — context ESET notes when discussing the 8088 hunt.
- ESET spots CVE-2025-8088 being exploited in the wild
- ESET reports it to WinRAR; 7.13 beta 1 ships the same day
- WinRAR 7.13 (stable) is released — the fix
- CVE-2025-8088 is published
- CISA KEV remediation due dateThe CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
The scanner blind spot: "no public exploit" ≠ safe
Here's the honest, uncomfortable part. If you'd queried an exploit index for CVE-2025-8088, it would have told you there was nothing to worry about — no Metasploit module, no Nuclei template, no public PoC. Our own index still returns exactly that. Meanwhile two nation-state-adjacent groups were running weaponized samples against real targets. "No public exploit" is a statement about GitHub, not about the wild.
| Signal | What it said for CVE-2025-8088 | What it did NOT tell you |
|---|---|---|
| CVSS 8.8 (HIGH) | Full RCE impact — but needs a user to open the archive (UI:R) | Nothing about how likely exploitation is |
| EPSS 0.809 (99.6th pct) | Among the most likely-to-be-exploited CVEs alive | Not proof exploitation is happening |
| CISA KEV | Confirmed exploited in the wild — RomCom + a second actor | The 'why now' — pair it with the impact + likelihood |
| Public-PoC index | 0 Metasploit / Nuclei / public PoC | Absence of a public PoC ≠ absence of a working weapon |
What to do
- Update every Windows host to WinRAR 7.13 or later — that is the fix. Anything ≤ 7.12 is exposed.
- Remember WinRAR has no auto-update: an install from a year ago is still 7.12 until a human downloads and runs 7.13.
- Chase the long tail — Windows UnRAR.dll, the command-line tools, the portable UnRAR source, and third-party apps that bundle an old UnRAR. dtSearch < 2023.01 is explicitly affected.
- Treat unsolicited RAR attachments — especially CV / job-application lures — as hostile until proven otherwise.
- Behavioural watch (from ESET's analysis): a freshly-extracted DLL landing in %TEMP% and a new .lnk appearing in the Startup folder right after an archive is opened.
Get-ChildItem 'C:\Program Files\WinRAR\WinRAR.exe','C:\Program Files (x86)\WinRAR\WinRAR.exe' -ErrorAction SilentlyContinue | ForEach-Object { '{0} -> {1}' -f $_.FullName, $_.VersionInfo.ProductVersion }Scores & KEV status verified on 2026-07-23