{
  "cveId": "CVE-2025-8088",
  "url": "https://patchblox.com/security/cve/CVE-2025-8088",
  "summary": "CVE-2025-8088 is fixed in 2 products on 2 platforms, first by WinRAR 7.13.0, released July 28, 2025. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on August 12, 2025, with known ransomware use. Patch Radar priority: Patch now.",
  "title": "RARLAB WinRAR Path Traversal Vulnerability",
  "description": "A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by\u00A0Anton Cherepanov, Peter Ko\u0161in\u00E1r, and Peter Str\u00FD\u010Dek\n     from ESET.",
  "published": "2025-08-08T12:15:29Z",
  "severity": "",
  "cvss": 8.4,
  "cwe": "CWE-35: Path traversal",
  "epss": 0.94008,
  "epssPercentile": 0.99847,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": true,
  "disclosed": false,
  "kev": {
    "added": "2025-08-12T00:00:00Z",
    "due": "2025-09-02T00:00:00Z",
    "ransomware": true,
    "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
  },
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2025-8088",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "WinRAR",
      "fixedVersion": "7.13.0",
      "fix": "WinRAR 7.13.0",
      "url": "https://patchblox.com/security/fix/windows-app/rarlab.winrar-7.13.0",
      "released": "2025-07-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.5.4-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21831-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21831-1",
      "released": "2026-09-11T12:01:10Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "sles 15.6",
      "fixedVersion": "1.5.4-150600.18.31.1",
      "fix": "SUSE-SU-2026:4180-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4180-1",
      "released": "2026-09-14T14:49:34Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "sles 15.7",
      "fixedVersion": "1.5.4-150600.18.31.1",
      "fix": "SUSE-SU-2026:4180-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4180-1",
      "released": "2026-09-14T14:49:34Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "sles 16.0",
      "fixedVersion": "1.5.4-160000.1.1",
      "fix": "SUSE-SU-2026:23727-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23727-1",
      "released": "2026-09-11T12:00:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}