CVE-2018-20250
High 7.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- WinRAR Absolute Path Traversal Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Metrics
- CVSS 3.1
-
7.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 96% (percentile: 100) as of 1 November 2026
- CWE
- CWE-36, CWE-22
Affected products
rarlab: winrar
References
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Vali… ExploitThird Party AdvisoryVDB Entry
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE ExploitThird Party Advisory
- https://research.checkpoint.com/extracting-code-execution-from-winrar/ ExploitPress/Media CoverageThird Party Advisory
- https://www.exploit-db.com/exploits/46552/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/46756/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Vali… ExploitThird Party AdvisoryVDB Entry
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE ExploitThird Party Advisory
- https://research.checkpoint.com/extracting-code-execution-from-winrar/ ExploitPress/Media CoverageThird Party Advisory
- https://www.exploit-db.com/exploits/46552/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/46756/ ExploitThird Party AdvisoryVDB Entry