CVE-2018-20250
- State
- Published
- Severity
- 7.8 High
- Published
- Feb 5, 2019
- Updated
- Aug 13, 2026
- Reserved
- Dec 19, 2018
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-36 Absolute Path Traversal
Affected Products
| Product | Versions |
|---|---|
WinRARCheck Point Software Technologies Ltd. |
|
References
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- 46552exploit
- 106948vdb-entry
- https://www.win-rar.com/whatsnew.html
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- 46756exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.