CVE-2018-20250
Check Point Software Technologies Ltd. WinRAR
Published 5 Feb 2019 · updated 13 Aug 2026 · Analyzed
7.8 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 15 Feb 2022, with a remediation deadline of 15 Aug 2022 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply updates per vendor instructions.
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
References
- packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
- www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace · Third Party Advisory
- www.securityfocus.com/bid/106948 · Broken Link, Third Party Advisory, VDB Entry
- github.com/blau72/CVE-2018-20250-WinRAR-ACE · Exploit, Third Party Advisory
- research.checkpoint.com/extracting-code-execution-from-winrar/ · Exploit, Press/Media Coverage, Third Party Advisory
- www.exploit-db.com/exploits/46552/ · Exploit, Third Party Advisory, VDB Entry
- www.exploit-db.com/exploits/46756/ · Exploit, Third Party Advisory, VDB Entry
- www.win-rar.com/whatsnew.html · Release Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250 · US Government Resource