CVE-2025-8088
KEV
🔴 Łataj teraz
Wrażliwość na przejście ścieżki w WinRAR na Windows umożliwia wykonanie dowolnego kodu.
CVSS
8.8
EPSS
94.5%
Exploit
weaponized
Vendor
microsoft
Opis źródłowy (NVD)
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
path-traversal
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.8 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 94.5% |
| Opublikowano (NVD) | 2025-08-08 12:15:29 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-11 04:17:18 UTC |
Referencje
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 (security@eset.com) [Release Notes]
- https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/ (af854a3a-2127-422b-91ae-364da2661108) [Press/Media Coverage]
- https://support.dtsearch.com/faq/dts0245.htm (af854a3a-2127-422b-91ae-364da2661108) [Third Party Advisory]
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day (af854a3a-2127-422b-91ae-364da2661108) [Third Party Advisory]
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo (af854a3a-2127-422b-91ae-364da2661108) [Mitigation, Third Party Advisory]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]
- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Press/Media Coverage]