Description
Windows版本的WinRAR软件在解压压缩文件中包含的备用数据流(ADS)文件时，存在路径穿越漏洞。攻击者可以创建包含恶意ADS流的压缩文件，用户解压时会将恶意ADS流文件释放到任意目录，从而执行任意代码。
WinRAR路径穿越漏洞(CVE-2025-8088)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-8088
https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-
https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
https://bbs.kanxue.com/thread-288363-1.htm
https://www.cnblogs.com/allastyle2025/p/19566619
https://cloud.tencent.com/developer/article/2563725
https://nic.imu.edu.cn/info/1095/1878.htm
https://blog.csdn.net/2301_80906044/article/details/159589435