CVE-2018-20250 KEV EXPLOIT
7.8
HIGH · CVSS 3.1 · EPSS 96% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2022-08-15.
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Scoring
| CVSS | 7.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 96% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-36 |
| On CISA KEV | yes — remediate by 2022-08-15 |
| Public exploit | yes |
| Published | 2019-02-05 |
| Last modified | 2026-08-13 |
CISA KEV
| Name | WinRAR Absolute Path Traversal Vulnerability |
|---|---|
| Added | 2022-02-15 |
| Due | 2022-08-15 |
| Vendor / product | RARLAB / WinRAR |
| Ransomware use | known |
Affected (1)
| Vendor | Product |
|---|---|
| rarlab | winrar |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit) | 2019-04-25 |
| exploit-db | WinRAR 5.61 - Path Traversal | 2019-02-22 |
References
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- http://www.securityfocus.com/bid/106948
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- https://www.exploit-db.com/exploits/46552/
- https://www.exploit-db.com/exploits/46756/
- https://www.win-rar.com/whatsnew.html
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- http://www.securityfocus.com/bid/106948
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- https://www.exploit-db.com/exploits/46552/
- https://www.exploit-db.com/exploits/46756/
- https://www.win-rar.com/whatsnew.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
→ the Explorer · watch your stack · NVD