What’s Vulnerable › Vulnerabilities

CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-02-15
• EPSS: 96.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-05 · updated 2026-08-13
• Weakness: CWE-36

Description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

Affected products

• WinRAR: through 5.61

References

• http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
• http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
• http://www.securityfocus.com/bid/106948
• https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
• https://research.checkpoint.com/extracting-code-execution-from-winrar/
• https://www.exploit-db.com/exploits/46552/
• https://www.exploit-db.com/exploits/46756/
• https://www.win-rar.com/whatsnew.html
• http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
• http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
• http://www.securityfocus.com/bid/106948
• https://github.com/blau72/CVE-2018-20250-WinRAR-ACE

Get alerted when CVE-2018-20250 or the next vulnerability affects your stack