The WINRAR program development team has announced the most famous tool for compressing and deciphering file pressure, the issuance of a new update that deals with a dangerous security vulnerability that is currently being exploited actively, and this vulnerability was ranked under the CVE-2025-8088 ID with a risk of 8.8 out of 10.
Details of the gap and its effect
The vulnerability is related to a problem in “Path Travesal” in the Windows version of Winrar that allows the attackers to implement random software instructions by creating malicious archives that have been specially modified for that, and when a file is pressed inside this archive, the program may be forced to use an undesirable path, which may lead to writing harmful files in sensitive places on the system.
WINRAR indicated in an official statement that the previous versions of the program and its various types such as RAR, UNRAR and UNRAR.DLL were subject to this danger, which made the update to version 7.13 issued on July 31, 2025 to a utmost necessity to protect users.
Who discovered the vulnerability and who exploits it?
Three researchers from ESET, Anton Cherbanov, Peter Kosenar and Peter Strikes, were behind the discovery of this vulnerability and the WinRar team informing it to be fixed, yet it is not yet clear who are the authorities that use this gap in real attacks.
According to a report of the Russian cyberspace security company Bi.zone, there are indications that the hackers group known as “Paper Werewolf” has taken advantage of this vulnerability along with another similar gap that was corrected in June 2025 to target Russian institutions through campaigns that carry malicious archives.
It is interesting that one of the actors named “Zeroplayer” had announced in July 2025 the sale of an exploitation of this gap in a Russian electronic forum at a price of $ 80,000, indicating that the attacking group may have obtained this tool and used it in its operations.
How are the attacks?
The attacks are carried out via e -mail messages that contain carefully controlled archives that contain malware, and when opening these archives, the vulnerability is used to enter files in sensitive folders such as Windows starting folder, which allows the implementation of software instructions when the system is running later.
One of the monitored malware that uses advanced techniques to download additional harmful software from the Internet, which increases the risk of penetration and makes it more difficult.
7-Zip update and the importance of updating archiving programs
In a similar context, the 7-ZIP archiving tool announced a correction of another dangerous security loophole related to writing random files, which was mainly targeting Unix systems, but it may also affect Windows in certain cases, and version 25.01 of 7-Zip came to close this gap and prevent exploitation.
This explains the importance of updating all archiving programs periodically and not relying on old versions that may carry security risks that threaten user data and devices.
