CVE-2018-20250

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Aug 13, 2026

Description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-36 CWE-22

Affected software

Vendor	Product	Versions
Check Point Software Technologies Ltd.	WinRAR	All versions prior and including 5.61

References

http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_aceThird Party Advisory
http://www.securityfocus.com/bid/106948Broken Link, Third Party Advisory, VDB Entry
https://github.com/blau72/CVE-2018-20250-WinRAR-ACEExploit, Third Party Advisory
https://research.checkpoint.com/extracting-code-execution-from-winrar/Exploit, Press/Media Coverage, Third Party Advisory
https://www.exploit-db.com/exploits/46552/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46756/Exploit, Third Party Advisory, VDB Entry
https://www.win-rar.com/whatsnew.htmlRelease Notes
http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_aceThird Party Advisory
http://www.securityfocus.com/bid/106948Broken Link, Third Party Advisory, VDB Entry
https://github.com/blau72/CVE-2018-20250-WinRAR-ACEExploit, Third Party Advisory
https://research.checkpoint.com/extracting-code-execution-from-winrar/Exploit, Press/Media Coverage, Third Party Advisory
https://www.exploit-db.com/exploits/46552/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46756/Exploit, Third Party Advisory, VDB Entry
https://www.win-rar.com/whatsnew.htmlRelease Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250US Government Resource

Timeline

Published: Feb 5, 2019
Last modified: Aug 13, 2026
Added to CISA KEV: Feb 15, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-202515.5In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. Th CVE-2018-202527.8In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive CVE-2018-202537.8In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive CVE-2018-20264.3IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal pro CVE-2018-20286.5IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the atta CVE-2018-202986.5S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NT CVE-2018-202999.8An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. CVE-2018-203009.8Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this CVE-2018-203016.5An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registrat CVE-2018-203026.1An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.CVE-2018-203037.5In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a fi CVE-2018-203046.5wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argum