← CVE Radar
CVE-2018-20250WinRAR Absolute Path Traversal Vulnerability
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
7.8 HIGHEPSS 96.00%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 6.8 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Aug 15, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2018-20250
- Status
- Analyzed
- Assigner (CNA)
- checkpoint
- Published
- Feb 5, 2019
- Last modified
- 2026-08-13 05:17 UTC
Affected Products
As published by the CNA in the CVE record.
Check Point Software Technologies Ltd.WinRAR1 version range
- All versions prior and including 5.61
References
- packetstormsecurity.com http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- rapid7.com http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- securityfocus.com http://www.securityfocus.com/bid/106948
- github.com https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.com https://research.checkpoint.com/extracting-code-execution-from-winrar/
- exploit-db.com https://www.exploit-db.com/exploits/46552/
- exploit-db.com https://www.exploit-db.com/exploits/46756/
- win-rar.com https://www.win-rar.com/whatsnew.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250