VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 03:28 UTC
← Dashboard

CVE-2025-8088

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ES…

Read full description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CVSS 8.4 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
2.3/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.4: +1.26
  • Fresh EPSS: 94.01%: +0.47

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 30 documents and public datasets.

Hype components

Headline sample (25%)
80/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL23/100

Sources and documents

Cisco Talos Blog
Press · 14 Oct 2026, 14:00 · Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Techzine Global
Press · 07 Aug 2026, 07:00 · WinRAR vulnerability being exploited in ransomware attacks, CISA warns - Techzine Global
Security Affairs
Press · 10 Jun 2026, 07:00 · WinRAR Flaw CVE-2025-8088 - Security Affairs
Security Affairs
Press · 10 Jun 2026, 07:00 · Russian APTs Still Exploiting Patched WinRAR Flaw CVE-2025-8088 - Security Affairs
The Hacker News
Press · 09 Jun 2026, 07:00 · WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - The Hacker News
See all 30 source documents
Rescana
Press · 09 Jun 2026, 07:00 · Active Exploitation of WinRAR CVE-2025-8088 by Russia-Aligned APTs Targets Ukrainian Government with Advanced Stealer Malware - Rescana
www.trendmicro.com
Press · 08 Jun 2026, 07:00 · Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open - www.trendmicro.com
tech-insider.org
Press · 03 Jun 2026, 07:00 · WinRAR Vulnerability CVE-2025-8088 Hits 500M Users [2026] - tech-insider.org
SC Media
Press · 02 Jun 2026, 07:00 · Russian hackers exploit WinRAR vulnerability for data theft - SC Media
The Hacker News
Press · 02 Jun 2026, 07:00 · Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine - The Hacker News
Trellix
Press · 12 Mar 2026, 07:00 · Malware-As-A-Service Redefined: Why XWorm is outpacing every other RAT in the underground malware market - Trellix
Mishcon de Reya LLP
Press · 23 Feb 2026, 08:00 · Unzipped and Exposed: Cybercriminals exploit WinRAR bug - Mishcon de Reya LLP
Infosecurity Magazine
Press · 05 Feb 2026, 08:00 · New Hacking Campaign Exploits Microsoft Windows WinRAR Vulnerability - Infosecurity Magazine
Check Point Research
Press · 04 Feb 2026, 08:00 · Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia - Check Point Research
Security Affairs
Press · 29 Jan 2026, 08:00 · Nation-state and criminal actors leverage WinRAR flaw in attacks - Security Affairs
SQ Magazine
Press · 28 Jan 2026, 08:00 · Google Warns of Active WinRAR Exploits Targeting Unpatched Windows Systems - SQ Magazine
SOC Prime
Press · 28 Jan 2026, 08:00 · CVE-2025-8088: WinRAR Flaw Abused for Startup Persistence - SOC Prime
GBHackers News
Press · 28 Jan 2026, 08:00 · Google Alerts Users to WinRAR Vulnerability Exploited for Windows System Takeover - GBHackers News
Help Net Security
Press · 28 Jan 2026, 08:00 · WinRAR vulnerability still a go-to tool for hackers, Mandiant warns - Help Net Security
The Register
Press · 28 Jan 2026, 08:00 · Everyone’s exploiting a WinRAR bug to drop RATs - The Register
Dark Reading
Press · 28 Jan 2026, 08:00 · Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest - Dark Reading
SecurityWeek
Press · 28 Jan 2026, 08:00 · APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability - SecurityWeek
The Hacker News
Press · 28 Jan 2026, 08:00 · Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088 - The Hacker News
Google Cloud
Press · 27 Jan 2026, 08:00 · Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 - Google Cloud
BleepingComputer
Press · 27 Jan 2026, 08:00 · WinRAR path traversal flaw still exploited by numerous hackers - BleepingComputer
Cyfirma
Press · 23 Jan 2026, 08:00 · Weaponized WinRAR Exploitation and Stealth Deployment of Fileless .NET RAT - Cyfirma
The Hacker News
Press · 10 Dec 2025, 08:00 · Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups - The Hacker News
Securelist
Press · 03 Dec 2025, 08:00 · Analyzing the vulnerability landscape in Q3 2025 - Securelist
Qualys
Press · 05 Sep 2025, 07:00 · CVE-2025-8088 WinRAR Exploit: From Zero-Day to Zero-Risk with TruRisk™ Eliminate - Qualys
WeLiveSecurity
Press · 11 Aug 2025, 07:00 · Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability - WeLiveSecurity

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 2.3 · reality 8.7 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

7

Public exploit entries / repo candidates

See 7 repos with metrics
RepositoryStarsForksLanguageUpdated
sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-7231Python13 Aug 2025, 11:09
onlytoxi/CVE-2025-8088-Winrar-Tool5516Python18 Aug 2025, 21:16
knight0x07/WinRAR-CVE-2025-8088-PoC-RAR4412—12 Aug 2025, 13:25
pexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC21Python17 Aug 2025, 07:00
0xAbolfazl/CVE-2025-8088-WinRAR-PathTraversal-PoC10Python16 Aug 2025, 23:03
ghostn4444/CVE-2025-808800Python29 Aug 2025, 06:17
papcaii2004/CVE-2025-8088-WinRAR-builder01Python27 Oct 2025, 08:17
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.4; EPSS 94.0%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
local access, no prior privileges, active user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:47.664445+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
08 Aug 2025, 11:11
First press mention
11 Aug 2025, 07:00
Added to the CISA KEV catalog
12 Aug 2025, 00:00
Latest press mention
14 Oct 2026, 14:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
7 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar