CVE-2018-20250
Act now ● On CISA KEV — actively exploited used in ransomware
Actively exploited — on the CISA KEV list.
CVSS base
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
96.3%
99.9th percentile
CISA KEV
Listed
Added 2022-02-15 · patch by 2022-08-15
Weakness / dates
CWE-22
Published 2019-02-05 · modified 2026-08-13
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Affected
References
- exploit http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- http://www.securityfocus.com/bid/106948
- exploit https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- exploit https://research.checkpoint.com/extracting-code-execution-from-winrar/
- exploit https://www.exploit-db.com/exploits/46552/
- exploit https://www.exploit-db.com/exploits/46756/
- https://www.win-rar.com/whatsnew.html
- exploit http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- http://www.securityfocus.com/bid/106948
- exploit https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- exploit https://research.checkpoint.com/extracting-code-execution-from-winrar/
- exploit https://www.exploit-db.com/exploits/46552/
- exploit https://www.exploit-db.com/exploits/46756/
- https://www.win-rar.com/whatsnew.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250