I wanted to post a serious heads-up for anyone using WinRAR, especially since the program doesn't auto-update.

There is a new, critical vulnerability (CVE-2025-8088) that is currently being exploited in the wild. This isn't just a potential threat; it's a zero-day flaw that has been used in targeted phishing campaigns to install malware.

What the vulnerability does:

The flaw is a "path traversal" bug. This allows an attacker to create a malicious archive file (RAR or ZIP) that, when you open it, can place malicious files into sensitive system directories, such as your Windows Startup folder. This means that a seemingly harmless file could install malware that automatically runs every time you log in to your computer.

Who is affected?

All versions of WinRAR prior to 7.13 are vulnerable.

What you need to do:

You must manually update WinRAR to version 7.13 or later.

1. Go to the official website: https://www.rarlab.com/download.htm
2. Download the latest 64-bit installer.
3. Run the installer to update your version of the software.

Please, don't ignore this. This is a serious security risk, and simply having an outdated version of a program you use frequently is a huge vector for attackers. Check your version and update it now.

Fact checked