This repository contains a **defensive, read-only analysis utility** for **CVE-2025-8088**.
This tool **scans** existing RAR5 archives and reports suspicious characteristics associated with the CVE-2025-8088 path-traversal / alternate-data-stream (ADS) abuse. It **only reads and inspects** an archive — it never creates, crafts, patches, attaches, or extracts anything.
> **Disclaimer:** This tool is a *scanner*, not a proof-of-concept exploit. It is for educational, defensive, and research purposes only. Do not use it to harm systems or networks. The author is not responsible for misuse or damage caused by this script.
**CVE-2025-8088** (CVSS 8.4) is a path traversal vulnerability in WinRAR, affecting Windows versions up to **7.12**, as well as related tools like **UnRAR.dll** and its portable source code.
The flaw allows attackers to embed malicious payloads in **alternate data streams (ADSes)** within specially crafted RAR files, enabling extraction to sensitive system locations (e.g., the Windows Startup folder) using path-traversal sequences (`..`). This can lead to automatic execution of malicious files, such as **DLLs** or shortcut (`.lnk`) files, upon system reboot.
- **First Observed:** Exploitation in the wild began on **July 18, 2025** (per ESET)
- **Patch Availability:** Fixed in WinRAR **7.13**, released on **July 30, 2025**
- **Attackers:** Linked to the Russia-aligned **RomCom** group (aka Storm-0978, Tropical Scorpius, UNC2596), known for cyberespionage and financially motivated attacks
- **Attack Method:** Spearphishing emails with RAR files disguised as job applications, targeting finance, defense, manufacturing, and logistics sectors in Europe and Canada
The scanner parses RAR5 archive headers **natively** (in pure Python) and inspects each stored file entry for characteristics commonly associated with CVE-2025-8088 abuse. It flags suspicious entries but **never extracts, runs, or modifies anything**.
- **Read-only:** Opens files in read mode only. It never writes, deletes, patches, or extracts anything.
- **No external dependencies:** The scanner requires only a standard Python installation (3.10+) and does not need `rar.exe`, WinRAR, or any third-party tool.
- **No network access:** Never contacts external servers or downloads anything.
- **Cross-platform:** Runs identically on Windows, macOS, and Linux.
| `ADS_ENTRY` | A colon inside the stored name (e.g., `"resume.txt:payload"`) — an alternate data stream |
| `ABSOLUTE_PATH` | An absolute path (e.g., `"C:\..."`) |
| `PATH_TRAVERSAL` | A `..` used as a complete path component |
| `SUSPICIOUS_TARGET:` | A name pointing at a sensitive destination (e.g., `startup`, `programdata`, `appdata\roaming\microsoft\windows`, `start `, `sendto`, `recent`) |
> **Note:** Absence of findings is **not** a guarantee of safety. Maliciously crafted archives may use obfuscation techniques that bypass these heuristics.
This script only inspects RAR5 archives you already have. It requires only a standard Python installation (3.10+).
| Argument | Description | Required? | Default |
|---------------|------------------------------------------------------------------------------------------------------|-----------|---------|
| `--file` | Path to an existing RAR5 archive to analyze | Yes | - |
| `--rar` | Path to `rar.exe` (only used with `--list`; auto-discovered if omitted) | No | Auto-discovered |
| `--list` | Also list archive contents via `rar.exe r` (requires `rar.exe`) | No | `False` |
| `--verbose` | Print every parsed entry, not just the suspicious ones | No | `False` |
Analyze a suspicious archive and print only the suspicious entries:
Analyze an archive and also list its contents using `rar.exe` (auto-discovered on this machine):
python poc.py --file suspicious.rar --list
Point at a specific `rar.exe` and print every parsed entry:
python poc.py --file suspicious.rar --rar "C:\Program Files\WinRAR\rar.exe" --list --verbose
- **Update WinRAR** to version **7.13 or later** (released July 30, 2025).
- Do **not** extract archives from untrusted sources on an unpatched system (WinRAR ≤ 7.12).
- Use this scanner to **pre-inspect** downloaded RAR5 archives before opening them.
- Monitor for unexpected files appearing in sensitive locations such as the Windows Startup folder.
This vulnerability was first observed in the wild by **ESET** on **July 18, 2025**, and is attributed to the **RomCom** hacking group.
For more on RomCom's tactics, see **SOCRadar Threat Actor Intelligence**.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
