CVE-2025-8088Vulnerability
RARLAB WinRAR Path Traversal Vulnerability
Reported by 12 independent sources · first reported by Trend Micro Research · last reported
Last reported 5 days ago
Fix due 2 Sep 2025
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
13 reports, newest first · the exact sentence from each-
19th October – Threat Intelligence Report“Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.”
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government“It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros.”
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“…hains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.”
-
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations“…-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088.”
-
TAG-193’s Regional Espionage Operations“Observed in April 2026 and likely used against Armenia’s Ministry of Foreign Affairs, this chain exploited the WinRAR vulnerability CVE-2025-8088 to place malware in the Windows Startup folder, enabling execution when the user next signed in.”
-
Cyber Brief 26-02 - January 2026“State and criminal actors exploit WinRAR CVE-2025-8088”
-
Exploits and vulnerabilities in Q2 2026“CVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218.”
-
June 2026 CVE Landscape“CVE-2025-8088”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…lde;o, el grupo también introdujo una nueva técnica: a partir del 26 de septiembre de 2025, comenzó a abusar de CVE-2025-8088, una vulnerabilidad en WinRAR, para colocar su habitual downloader HTA malicioso en la carpeta Inicio de la víctima.”
-
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus“November 2025: Ukraine — Drone-Related Lures and Deployment via CVE-2025-8088”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“Late in the year, the group also introduced a new technique – from September 26th, 2025 onward, it began abusing CVE-2025-8088, a WinRAR vulnerability, to place its usual malicious HTA downloader into the victim’s Startup folder.”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“This archive exploits the CVE-2025-8088 vulnerability to extract a hidden HTA file directly into the user’s Windows Startup directory.”
-
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open“Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships.”
Indicators reported together
named in the same reports- teletype[.]inin 3 reports
- devtunnels[.]msin 2 reports
- mil.gov[.]uain 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- write[.]asin 2 reports
- lesma[.]euin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- tebi[.]ioin 2 reports
- de-fra.i3storage[.]comin 2 reports
Copy these 13 indicators · defanged
Also named with it: CVE-2025-6218, CVE-2026-21509, CVE-2026-35273, CVE-2018-20250, CVE-2025-25257, CVE-2026-25089, CVE-2026-39808
Thanks — we review every report.