WinRAR on Windows路径遍历漏洞

详细信息

漏洞类型

其他

漏洞描述

Windows版本WinRAR、Windows版UnRAR.exe、UnRAR.dll（所有架构）7.12及以前版本在解压时对压缩包内“文件名”字段校验不足，允许“../”或绝对路径（如 C:\…）穿越，可在任意目录写入文件。

修复建议

请升级到WinRAR 7.13或更高版本，参考链接： https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5

参考链接

• https://access.redhat.com/security/cve/cve-2025-8088

  CNNVD

• https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088

  NVD · Press/Media Coverage

• https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5

  CVE · Release Notes

• https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day

  NVD · Third Party Advisory

• https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo

  NVD · Third Party Advisory · Mitigation

• https://support.dtsearch.com/faq/dts0245.htm

  NVD · Third Party Advisory

• https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/

  NVD · Press/Media Coverage

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088

  NVD · US Government Resource

• https://www.suse.com/security/cve/CVE-2025-8088

  OSV

• https://www.suse.com/security/cve/CVE-2026-20337

  OSV

• https://www.suse.com/security/cve/CVE-2026-20338

  OSV

• https://www.suse.com/security/cve/CVE-2026-20339

  OSV

• https://www.suse.com/security/cve/CVE-2026-20345

  OSV

• https://www.suse.com/security/cve/CVE-2026-20346

  OSV

• https://www.suse.com/security/cve/CVE-2026-20347

  OSV

• https://www.suse.com/security/cve/CVE-2026-20348

  OSV

• https://www.suse.com/security/cve/CVE-2026-46671

  OSV

• https://osv.dev/vulnerability/openSUSE-SU-2026:11583-1

  OSV