Loading story…
WinRAR developers released version 7.13 to fix CVE-2025-8088, a severe directory traversal vulnerability in WinRAR for Windows and UnRAR for Windows that was reportedly exploited in the wild. The flaw allowed specially crafted archives to extract files outside the intended destination, including into the Windows Startup folder, enabling malware to launch automatically on the next system boot. Affected software included WinRAR versions prior to 7.13 and UnRAR 7.0 for Windows.
According to CSIRT.SK, the vulnerability was used frequently in phishing campaigns to deliver malware, increasing the risk to enterprise users who open archive attachments from untrusted sources. The issue was discovered by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček, and defenders were urged to update immediately and inspect Startup folder contents for suspicious files or shortcuts that may indicate compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček discovered CVE-2025-8088, the WinRAR and UnRAR for Windows vulnerability later fixed in version 7.13. The referenced content attributes the discovery to these researchers but does not provide a specific date for it.
WinRAR developers released version 7.13 to fix CVE-2025-8088, a directory traversal vulnerability affecting WinRAR for Windows and UnRAR for Windows. The flaw had been actively exploited in phishing campaigns to place malicious files in the Windows Startup folder for execution on reboot.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed a **19-year-old vulnerability** in WinRAR that could be exploited to achieve **arbitrary code execution** when a user opened a specially crafted archive. The issue affected WinRAR's handling of the legacy `ACE` archive format through the bundled `UNACEV2.DLL` library, allowing attackers to manipulate file extraction paths and place malicious executables into startup folders or other sensitive locations. The flaw meant a booby-trapped archive could trigger malware execution on the next system reboot or user logon, turning a common archive-opening action into an infection vector. Because WinRAR had an estimated **hundreds of millions of users**, the disclosure highlighted broad exposure and the risk of weaponized archive files in phishing and malware campaigns until users upgraded to a patched version that removed support for the vulnerable `UNACEV2.DLL` component.
Jul 12, 2026
Google Threat Intelligence Group reported broad exploitation of **CVE-2025-8088**, a critical WinRAR path traversal vulnerability that lets attackers use malicious RAR archives with Windows Alternate Data Streams to write files to arbitrary locations. In observed attacks, the flaw was commonly used to drop payloads into the Windows Startup folder so malware would execute at the next user logon, giving intruders persistence after a victim opened a crafted archive. The activity has been linked to both state-backed and financially motivated actors, including clusters associated with Russia and China, with targeting focused on military, government, and technology organizations. Exploitation began as early as July 18, 2025, and continued after RARLAB released a fix in **WinRAR 7.13** on July 30, 2025, turning the issue into an actively abused n-day vulnerability; defenders were urged to patch quickly, keep archive software updated, and rely on protections such as Safe Browsing and Gmail filtering to block weaponized files.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the WinRAR path traversal vulnerability, CVE-2025-6218, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. This flaw, which affects Windows-based versions of WinRAR prior to version 7.12, allows attackers to execute arbitrary code by tricking users into opening malicious archives or visiting compromised web pages. The vulnerability enables attackers to write files outside intended directories, potentially leading to code execution with the privileges of the current user, and can be exploited to place files in sensitive locations such as the Windows Startup folder. Multiple threat groups, including GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon, have been observed exploiting CVE-2025-6218 in the wild. Attacks have involved phishing emails containing malicious RAR archives, with some campaigns using the vulnerability to establish persistence and deploy trojans on targeted systems. RARLAB addressed the issue in June 2025 with the release of WinRAR 7.12, and users are urged to update to the latest version to mitigate the risk of exploitation. The vulnerability does not affect WinRAR versions for Unix or Android platforms.
Jun 29, 2026