WinRAR CVE-2025-8088 explained: Directory traversal vulnerability enables arbitrary file writes

RARLAB patched CVE-2025-8088 in WinRAR 7.13 after disclosure of a vulnerability in WinRAR ≤7.12 where malicious archives abuse NTFS alternate data streams with directory traversal in their stream names to cause arbitrary file writes to attacker-controlled locations (e.g., Windows Startup) during extraction; the issue has CVSS 8.4, can enable persistence though not direct execution, and is mitigated by updating to 7.13, avoiding untrusted archives, and applying application control and behavior-based detection.