CVE-2025-8088

WinRAR can open compressed files (archives). With this flaw, a malicious archive can trick the program into writing files to unintended locations, and that can lead to running harmful code when the archive is opened. Think of it like a “zip” package that, instead of just containing documents for delivery, also contains a hidden instruction to place items anywhere on your property—even outside the intended room.

This matters to you if you use or allow files to be opened on Windows with rarlab winrar, WinRAR GmbH WinRAR, or win.rar GmbH WinRAR. It’s also listed as affecting dtsearch dtsearch, so businesses using that product on Windows should include it in their check. Because exploitation is already known to be happening in real attacks, the risk is not just theoretical.

This is RED urgency: attackers are already exploiting it “in the wild,” and the likelihood of attempts in the coming month is very high. Since a malicious file can be delivered and then trigger code execution when opened, delays can turn a normal day of file handling into an incident. Act now to remove exposure by updating or hardening the affected software.

For Windows systems that may be exposed:

• Identify: Check which machines have rarlab winrar, WinRAR GmbH WinRAR, win.rar GmbH WinRAR, and whether dtsearch dtsearch is installed.
• Patch first: Update WinRAR to the newest version available from the vendor (the exact fixed version isn’t provided in the information you gave, so rely on the vendor’s release notes for the correct build).
• Operational control while patching: If any machine cannot be updated quickly, restrict the ability to open untrusted archives from email, web downloads, shared drives, or USB devices. Prefer blocking or quarantining suspicious archive files until the update is installed.
• User guidance: Instruct staff not to open unexpected or unsolicited archive files, even if they look like they come from a familiar contact.
• After updating: Confirm the WinRAR version changed successfully on each Windows machine.
• Monitor for follow-on issues: Because the vulnerability can lead to “arbitrary code execution,” watch your endpoints for suspicious behavior (for example, unexpected new processes shortly after opening an archive) and check security logs according to your normal incident-response process.
• If compromise is suspected: Isolate the affected machine from the network and follow your containment and remediation plan (or contact your IT/security support) before reinstalling or restoring.

CVE-2025-8088 is a path traversal vulnerability in the Windows version of WinRAR that can be used to craft malicious archive files. The practical impact reported is arbitrary code execution, meaning the attacker can run code on the victim system by abusing how the archive is processed.

Key context from the provided facts:

• Known exploited in the wild (CISA KEV): yes
• Exploitation status (from press): itw
• EPSS: 81.3% estimated probability of exploitation in the next 30 days (indicating a very high likelihood of attempts)
• Public exploit available: no and Nuclei detection template exists: no (so detection may rely on vendor guidance and normal security monitoring rather than easy signatures)
• Attack vector: Deliver a malicious archive file; when opened in the vulnerable WinRAR, it can write outside intended paths (path traversal) and lead to code execution.

Attribution note from the provided information: The issue was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET, and named actor activity is mentioned as SHADOW-EARTH-066 in rising press attention.