shaheeryasirofficial/cve-2025-8088CVE-2025-8088 is a critical path traversal vulnerability in WinRAR 7.12
CVE-2025-8088 is a critical path traversal vulnerability in WinRAR (versions 7.12 and prior). The flaw exists in the way the application processes archive entry filenames that utilize NTFS Alternate Data Streams (ADS). By tricking the extraction engine into misinterpreting the stream boundary, an attacker can write arbitrary files to sensitive locations such as the Windows Startup folder bypassing the user's intended extraction directory.
The core of the issue lies in the interaction between WinRAR's path sanitization logic and the Windows NTFS file system.
NTFS ADS Primer: NTFS allows files to contain multiple streams of data. The primary stream is the file content, while alternate streams are accessed via filename:streamname.
The Flaw: When WinRAR processes a crafted archive, it fails to correctly identify and strip malicious path sequences (like ..\) if they are embedded within or appended to an ADS specification.
Exploitation: An attacker creates a RAR entry with a name like:
SafeFile.txt:../..//../../Users/%Username%/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malicious.exe
During extraction, the sanitization routine incorrectly parses the : character, allowing the traversal sequence to escape the "sandbox" of the extraction folder.
| Component | Requirement |
|---|---|
| Operating System | Windows (NTFS File System required) |
| Software | WinRAR version 7.12 and below |
| User Interaction | Low (User must initiate extraction of a malicious archive) |
