CVEvulnerability
CVE-2018-20250
CISA Known Exploited Vulnerability
WinRAR Absolute Path Traversal Vulnerability — RARLAB WinRAR
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
- Added to KEV
- 2022-02-15
- Remediation due
- 2022-08-15
- Ransomware use
- Known
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2018-20250
- Status
- Analyzed
- Published
- 2019-02-05
- Last modified
- 2026-08-13
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-22, CWE-36
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Affected configurations
• rarlab winrar (<= 5.61)
Related
References
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace Third Party Advisory
- http://www.securityfocus.com/bid/106948 Broken Link, Third Party Advisory, VDB Entry
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE Exploit, Third Party Advisory
- https://research.checkpoint.com/extracting-code-execution-from-winrar/ Exploit, Press/Media Coverage, Third Party Advisory
- https://www.exploit-db.com/exploits/46552/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46756/ Exploit, Third Party Advisory, VDB Entry
- https://www.win-rar.com/whatsnew.html Release Notes
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace Third Party Advisory
- http://www.securityfocus.com/bid/106948 Broken Link, Third Party Advisory, VDB Entry
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE Exploit, Third Party Advisory
- https://research.checkpoint.com/extracting-code-execution-from-winrar/ Exploit, Press/Media Coverage, Third Party Advisory
- https://www.exploit-db.com/exploits/46552/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46756/ Exploit, Third Party Advisory, VDB Entry
- https://www.win-rar.com/whatsnew.html Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250 US Government Resource