WinRAR CVE-2025-8088: One Decoy PDF, One Hidden Stream, One Entry in Your Startup Folder

WinRAR has no auto-update. let that sink in. the single most common archive tool on Windows ships a path traversal flaw that drops files wherever the attacker wants, including your Startup folder, and the only patch mechanism is a human remembering to download a new build from a website that looks like it was designed in 2004. CVE-2025-8088 has been chained into real espionage intrusions. the fix is 7.13. your users are on 7.12.

what the bug actually is

CVE-2025-8088 is a directory traversal in how WinRAR handles alternate data stream (ADS) paths inside RAR archives on Windows. a crafted archive carries an innocuous visible file, like report.pdf, plus hidden ADS entries whose paths climb out of the extraction directory using ..\ sequences. when WinRAR extracts, the visible file lands where you expect and the hidden entry traverses to wherever the attacker pointed it. a very popular destination is the per-user Startup folder, because anything there runs at the next logon.

a sibling bug, CVE-2025-8089, covers related traversal behavior. both are fixed in WinRAR 7.13. versions below that, which is a staggering share of the installed base, extract these archives exactly as the attacker intended.

who is actually using it

this is not theoretical. the flaw was caught being exploited as a zero day in espionage campaigns attributed to RomCom (also tracked as Storm-0978) and to Paper Werewolf. the lure pattern is boring and effective: a resume, an invoice, a report, delivered as a RAR attachment. the victim sees the decoy document open normally. meanwhile the real payload has quietly been written into Startup, and the operator owns the box at next logon. no macro warning, no unsigned executable prompt at extraction, just a tool people trust doing what the archive told it to do.

step 1: craft the archive in a lab

the public PoCs build a RAR with a decoy entry and an ADS entry whose path uses traversal to reach the Startup directory. in the lab we point it at our own user profile and drop a harmless stub so we can prove the mechanism without shipping anything live.

python3 craft_cve_2025_8088.py --decoy report.pdf --payload calc_stub.exe \
    --traversal '..\..\..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upd.exe'

step 2: extract on an unpatched VM and watch it land

on an isolated Windows 10 VM running WinRAR below 7.13, extracting the archive shows only report.pdf in the output. but the hidden stream climbed out of Downloads and wrote upd.exe into the user’s Startup folder. nothing warned the user. nothing asked for consent.

step 3: detect and defend

there are three practical detections, and they stack.

Version. because WinRAR will not update itself, the single highest value control is simply knowing who is below 7.13. inventory it. a vulnerable version banner is your finding.

Startup folder changes. anything newly written to a per-user Startup directory deserves an alarm, period. this is cheap telemetry and it catches a whole family of persistence tricks, not just this one.

Archive inspection. YARA rules that flag ADS entries combined with ..\ traversal sequences in RAR files catch the weaponized archives at the mail gateway before a human ever double clicks.

the fix, and the uncomfortable part

• upgrade every WinRAR install to 7.13 or later. it is a manual download. build it into your patch process or it will not happen.
• consider whether endpoints need WinRAR at all. the built-in Windows archive handling covers most users, and fewer third party extractors means fewer manual-patch landmines.
• block or detonate RAR attachments at the gateway. if the business cannot live without them, at least inspect them.
• alarm on new files in per-user Startup and Run keys. this is the persistence step, and it is noisy if you are watching.

the uncomfortable part is that none of this is hard. the bug is understood, the patch exists, the detections are trivial. the reason RomCom keeps getting mileage out of a 2025 archive bug in 2026 is that software without auto-update plus humans without a patch process equals a persistent vulnerability no matter how good the vendor’s fix was. patch the archiver, watch the Startup folder, and stop trusting a RAR because it came with a nice PDF.