CVE-2025-8088: CWE-35 Path traversal in win.rar GmbH WinRAR
Indonesia's Banking, Financial Services, and Insurance sector faced significant cyber threats throughout 2026, including multiple alleged data breaches targeting major banking institutions and fintech platforms. Underground forums advertised compromised datasets containing customer information, account details, and sensitive documents, with varying levels of validation. Ransomware groups ICARUS and The Gentleman conducted extortion campaigns against financial organizations. China-linked APT groups including SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, and Shadow Campaigns demonstrated sophisticated capabilities through phishing operations, supply chain compromises, and zero-day exploitation. These state-aligned actors deployed advanced malware such as ValleyRAT, ABCDoor, LOTUSLITE, and custom backdoors for long-term espionage. The expanding digital banking ecosystem and regional financial connectivity have increased attack surfaces, requiring enhanced cyber resilience, continuous monitoring, a...
AI Analysis
Technical Summary
CVE-2025-8088 is a path traversal vulnerability (CWE-35) affecting the Windows version of WinRAR. This vulnerability enables an attacker to execute arbitrary code by creating specially crafted archive files that exploit the path traversal flaw. The vulnerability was identified and published by ESET researchers in August 2025. The CVSS 4.0 base score is 8.4, indicating high severity. No exploits have been observed in the wild, and as of the publication date, the vendor has not released any patches or official remediation.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system by leveraging crafted archive files. This could lead to unauthorized control or compromise of the system running the vulnerable WinRAR version.
Mitigation Recommendations
As of the current information, no patch or official remediation is available from the vendor. Users should exercise caution when opening archive files from untrusted sources. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Indicators of Compromise
- hash: 4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a
- domain: emezonhe.me
- cve: CVE-2025-8088
- domain: skycloudcenter.com
- domain: dog3rj.tech
- domain: q74vn.live
- domain: abwxjp5.me
- domain: servgate.me
- domain: pr0fu5a.me
- domain: zamstats.me
- domain: pickupweb.me
- domain: zrheblirsy.me
- domain: msonline.help
- domain: gouvn.me
- domain: abc.doublemobile.com
- domain: editor.gleeze.com
- domain: www.cosmosmusic.com
- domain: mcagov.cc
- domain: roldco.com
- domain: abc.3mkorealtd.com
- domain: abc.fetish-friends.com
- domain: abc.haijing88.com
- domain: abc.ilptour.com
- domain: abc.petitechanson.com
- domain: abc.sudsmama.com
- domain: abc.woopami.com
- domain: vnc.kcii2.com
- hash: 09b0bc41f8838949d5a1c442ee2e2ec9ff892fdc
- hash: a12db7b72879ac0f46079efd8c67e8ca0621f73b
- hash: cc6fd90785a528883b0203138348df8bad69bb1a
- hash: f0b182423107a04cf5f09b8559e656242a4fcc89
- domain: gpsfinance.co.id
CVE-2025-8088: CWE-35 Path traversal in win.rar GmbH WinRAR
Description
Indonesia's Banking, Financial Services, and Insurance sector faced significant cyber threats throughout 2026, including multiple alleged data breaches targeting major banking institutions and fintech platforms. Underground forums advertised compromised datasets containing customer information, account details, and sensitive documents, with varying levels of validation. Ransomware groups ICARUS and The Gentleman conducted extortion campaigns against financial organizations. China-linked APT groups including SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, and Shadow Campaigns demonstrated sophisticated capabilities through phishing operations, supply chain compromises, and zero-day exploitation. These state-aligned actors deployed advanced malware such as ValleyRAT, ABCDoor, LOTUSLITE, and custom backdoors for long-term espionage. The expanding digital banking ecosystem and regional financial connectivity have increased attack surfaces, requiring enhanced cyber resilience, continuous monitoring, a...
CVSS v4.0
Score 8.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-8088 is a path traversal vulnerability (CWE-35) affecting the Windows version of WinRAR. This vulnerability enables an attacker to execute arbitrary code by creating specially crafted archive files that exploit the path traversal flaw. The vulnerability was identified and published by ESET researchers in August 2025. The CVSS 4.0 base score is 8.4, indicating high severity. No exploits have been observed in the wild, and as of the publication date, the vendor has not released any patches or official remediation.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system by leveraging crafted archive files. This could lead to unauthorized control or compromise of the system running the vulnerable WinRAR version.
Mitigation Recommendations
As of the current information, no patch or official remediation is available from the vendor. Users should exercise caution when opening archive files from untrusted sources. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- ESET
- Date Reserved
- 2025-07-23T15:35:47.170Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a | — | |
hash09b0bc41f8838949d5a1c442ee2e2ec9ff892fdc | — | |
hasha12db7b72879ac0f46079efd8c67e8ca0621f73b | — | |
hashcc6fd90785a528883b0203138348df8bad69bb1a | — | |
hashf0b182423107a04cf5f09b8559e656242a4fcc89 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainemezonhe.me | — | |
domainskycloudcenter.com | — | |
domaindog3rj.tech | — | |
domainq74vn.live | — | |
domainabwxjp5.me | — | |
domainservgate.me | — | |
domainpr0fu5a.me | — | |
domainzamstats.me | — | |
domainpickupweb.me | — | |
domainzrheblirsy.me | — | |
domainmsonline.help | — | |
domaingouvn.me | — | |
domainabc.doublemobile.com | — | |
domaineditor.gleeze.com | — | |
domainwww.cosmosmusic.com | — | |
domainmcagov.cc | — | |
domainroldco.com | — | |
domainabc.3mkorealtd.com | — | |
domainabc.fetish-friends.com | — | |
domainabc.haijing88.com | — | |
domainabc.ilptour.com | — | |
domainabc.petitechanson.com | — | |
domainabc.sudsmama.com | — | |
domainabc.woopami.com | — | |
domainvnc.kcii2.com | — | |
domaingpsfinance.co.id | — |
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2025-8088 | — |
Threat ID: 6895e060ad5a09ad0002e7e5
Added to database: 08/08/2025, 11:32:48 UTC
Last enriched: 07/10/2026, 07:47:53 UTC
Last updated: 08/08/2026, 17:11:27 UTC
Views: 398
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.