Skip to content

CVE-2025-8088: Verified Repro With Script Download

CVE-2025-8088: WinRAR ADS Path Traversal — Arbitrary Code Execution via Crafted Archive CVE-2025-8088

Download script Open in Codespaces

CVE-2025-8088 is verified against the affected target. Vulnerability class: Path Traversal. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00090.

REPRO-2026-00090 Path Traversal Feb 17, 2026 CVE entry ↗ .txt
Severity
HIGH
CVSS
8.8
Reproduced in
123m 42s
Tool calls
548
Spend
$10.49
01 · Overview

What Is CVE-2025-8088?

CVE-2025-8088 is a high-severity path traversal (CWE-35) in the Windows version of WinRAR that allows arbitrary code execution via a crafted archive. It was exploited in the wild. Pruva reproduced it (reproduction REPRO-2026-00090).

02 · Severity & CVSS

CVE-2025-8088 Severity & CVSS Score

CVE-2025-8088 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level
8.8 / 10 CVSS base
Weakness CWE-35 — Path Traversal

High — serious impact or readily exploitable. Prioritize remediation.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2025-8088

$ pruva-verify REPRO-2026-00090
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00090/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2025-8088

Reproduced by Pruva's autonomous agents — 548 tool calls over 2h 4m. Full root-cause analysis and the complete transcript are below.

How the agent worked 1,230 events · 548 tool calls · 2h 4m
2h 4mDuration
548Tool calls
123Reasoning steps
1,230Events
12Dead-ends
Agent activity over 2h 4m
Support
8
Repro
872
Variant
346
0:00123:42

Root Cause and Exploit Chain for CVE-2025-8088

Summary

CVE-2025-8088 is a path traversal flaw in WinRAR for Windows that allows archives containing Alternate Data Streams (ADS) to write files outside the chosen extraction directory. A crafted RAR with ADS entries can drop a payload into the user's Startup folder when extracted, enabling arbitrary code execution on next login.

Impact

  • Package/component affected: WinRAR for Windows (and Windows UnRAR/UnRAR.dll/portable UnRAR).
  • Affected versions: WinRAR <= 7.12 (patched in 7.13).
  • Risk level and consequences: High. A crafted archive can write files outside the destination, enabling persistence and code execution (e.g., Startup folder payloads).

Root Cause

WinRAR's handling of ADS entries allows path traversal through relative path components (..) embedded in ADS stream names. When extracting a RAR with ADS entries, WinRAR resolves traversal segments relative to the extraction path and permits writing the ADS payload into unintended locations (e.g., Startup folder). WinRAR 7.13 release notes indicate this was fixed, suggesting validation was added to prevent traversal outside the destination.

Reproduction Steps

  1. Run repro/reproduction_steps.sh (wrapper for PowerShell script).
  2. The script installs WinRAR 7.12, downloads a public PoC generator, patches it to avoid PDF dependencies, generates an exploit RAR with multiple ADS traversal depths, then extracts it with WinRAR's rar.exe CLI.
  3. Evidence of reproduction is a payload.bat written to the user Startup folder and logged output indicating "Issue confirmed."

Evidence

  • Logs: logs/repro-<timestamp>.log (created per run).
  • Key excerpt (from successful runs):
    • "WinRAR version: 7.12.0"
    • "Exploit created: exploit.rar"
    • "VULNERABLE: payload written to startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.bat"
  • Environment: Windows sandbox, WinRAR 7.12 installed via rarlab installer, Python 3.12 used to run PoC generator.

Recommendations / Next Steps

  • Upgrade WinRAR to 7.13 or later on Windows hosts.
  • If WinRAR cannot be upgraded immediately, disable ADS handling or block extraction of untrusted archives.
  • Add regression tests that extract crafted ADS archives and ensure no writes occur outside the destination directory.

Additional Notes

  • Idempotency: repro/reproduction_steps.ps1 was run twice successfully; both runs produced the Startup payload and exited 0.
  • Limitation: The PoC relies on ADS traversal; Linux/Unix builds are not affected per vendor advisory.

CVE-2025-8088 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:001:32
0:00
session startedgpt-5.2-codex · ghsa-832g-3rcm-wcrf · ghsa-832
0:29
0:33
web search
0:43
0:43
extract_facts
no facts extracted
0:45
0:45
supportrepro
0:48
0:50
0:51
0:52
0:55
web search
1:03
1:06
1:09
$powershell -NoProfile -Command "Get-ChildItem Env: | Select-Object -First 5"
0.4s✓
Get-ChildItem Env: | Select-Object -First 5
1:15
1:22
web search
1:25
1:25
$choco -v
0.2s✓
'choco' is not recognized as an internal or external command,
operable program or batch file.
1:27
$powershell -NoProfile -Command "Get-Command winget"
0.3s✓
Get-Command winget
1:29
$powershell -NoProfile -Command "winget --version"
0.3s✓
winget --version
1:32
$powershell -NoProfile -Command "Invoke-WebRequest -UseBasicParsing https://www.rarlab.com/rar/winrar-x64-712.exe -OutFile C:\workspace\winrar-712.exe"
0.4s✓
Invoke-WebRequest -UseBasicParsing https://www.rarlab.com/rar/winrar-x64-712.exe -OutFile C:\workspace\winrar-712.exe

Artifacts and Evidence for CVE-2025-8088

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2025-8088

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2025-8088 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2025-8088

Was CVE-2025-8088 exploited in the wild?

Yes. The vulnerability was exploited in the wild and was discovered by researchers from ESET (Anton Cherepanov, Peter Kosinar, and Peter Strycek).

Which versions of WinRAR are affected by CVE-2025-8088, and where is it fixed?

WinRAR for Windows (and Windows UnRAR / UnRAR.dll / portable UnRAR) versions <= 7.12 are affected. It is patched in 7.13 — upgrade to 7.13 or later.

How can I reproduce CVE-2025-8088?

Download the verified script from this page and run it in an isolated Windows environment with WinRAR <= 7.12. It extracts a crafted RAR containing ADS path-traversal entries and shows a file written outside the extraction directory (e.g. into Startup).
11 · References

References for CVE-2025-8088

Authoritative sources for CVE-2025-8088 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.