RARLAB · WinRAR
CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
Exploited in attacks
Used by ransomware
High 7.8 Attack chance: 96%
What it is
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CISA: WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: August 15, 2022
- Added to the CISA list
- February 15, 2022
- Published
- February 5, 2019
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 96% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-36
- More details
- NVD · CVE.org · CISA
All references (8)
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- https://www.exploit-db.com/exploits/46552/
- http://www.securityfocus.com/bid/106948
- https://www.win-rar.com/whatsnew.html
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.h…
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- https://www.exploit-db.com/exploits/46756/
More exploited flaws from RARLAB
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 9, 2025 | Path Traversal | WinRAR | High 7.8 | 90% |
| Aug 12, 2025 | Path Traversal | WinRAR | High 8.4 | 95% |
| Aug 24, 2023 | Code Execution | WinRAR | High 7.8 | 99.8% |
| Aug 9, 2022 | Directory Traversal | UnRAR | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.