ET EXPLOIT [CORELIGHT] RAR File ADS Path Traversal Inbound via HTTP (CVE-2025-8088)

Tim Peck@timpeck

•updated Nov 10, 2025•3•0•55

This rule detects an attempt to exploit a path traversal vulnerability (CVE-2025-8088) in RAR files delivered via HTTP. The exploit leverages Alternate Data Streams (ADS) and specific path traversal patterns to potentially write files outside of the intended directory. The detection is based on the presence of 'STM' in the HTTP response body and a PCRE regex matching a specific path traversal pattern.