RAR File ADS Path Traversal Inbound (CVE-2025-8088)

Tim Peck@timpeck

•updated Nov 10, 2025•0•59

This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.