# CVE-2018-20250

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

- Page: https://www.vulneraibility.com/cve/CVE-2018-20250
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2022-02-15; CISA due date 2022-08-15; known ransomware use
- EPSS: 96.00% (percentile 99.9)
- Public exploit code: 3 on Exploit-DB · 1 Metasploit module · 19 GitHub proofs of concept (first 2019-02-22)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2022-02-14)
- Weakness: CWE-36
- Published: 2019-02-05

## Affected versions

- Check Point Software Technologies Ltd. WinRAR: affected All versions prior and including 5.61

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- [other] https://research.checkpoint.com/extracting-code-execution-from-winrar/
- [exploit] https://www.exploit-db.com/exploits/46552/
- [other] http://www.securityfocus.com/bid/106948
- [other] https://www.win-rar.com/whatsnew.html
- [other] http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- [other] http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- [exploit] https://www.exploit-db.com/exploits/46756/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.