{"id":"CVE-2018-20250","aliases":["EUVD-2018-12813","GHSA-7v9q-j964-43qc"],"status":"published","title":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when...","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.96004,"percentile":0.99876,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-36"],"published":"2019-02-05T20:00:00Z","modified":"2026-08-13T05:17:17Z","kev":{"date_added":"2022-02-15","due_date":"2022-08-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-02-15"},{"source":"kev","since":"2022-02-15"}],"exploits":[{"source":"metasploit","id":"exploit/windows/fileformat/winrar_ace","title":"RARLAB WinRAR ACE Format Input Validation Remote Code Execution","type":"exploit","platform":"Windows","date":"2019-02-05","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace"},{"source":"exploitdb","id":"EDB-46552","title":"WinRAR 5.61 - Path Traversal","type":"local","platform":"windows","date":"2019-02-22","verified":true,"url":"https://www.exploit-db.com/exploits/46552"},{"source":"pocgithub","id":"QAX-A-Team/CVE-2018-20250","title":"QAX-A-Team/CVE-2018-20250","date":"2019-02-22","url":"https://github.com/QAX-A-Team/CVE-2018-20250"},{"source":"pocgithub","id":"WyAtu/CVE-2018-20250","title":"WyAtu/CVE-2018-20250","date":"2019-02-22","url":"https://github.com/WyAtu/CVE-2018-20250"},{"source":"pocgithub","id":"blunden/UNACEV2.DLL-CVE-2018-20250","title":"blunden/UNACEV2.DLL-CVE-2018-20250","date":"2019-02-22","url":"https://github.com/blunden/UNACEV2.DLL-CVE-2018-20250"},{"source":"pocgithub","id":"nmweizi/CVE-2018-20250-poc-winrar","title":"nmweizi/CVE-2018-20250-poc-winrar","date":"2019-02-22","url":"https://github.com/nmweizi/CVE-2018-20250-poc-winrar"},{"source":"pocgithub","id":"easis/CVE-2018-20250-WinRAR-ACE","title":"easis/CVE-2018-20250-WinRAR-ACE","date":"2019-02-23","url":"https://github.com/easis/CVE-2018-20250-WinRAR-ACE"},{"source":"pocgithub","id":"STP5940/CVE-2018-20250","title":"STP5940/CVE-2018-20250","date":"2019-02-28","url":"https://github.com/STP5940/CVE-2018-20250"},{"source":"pocgithub","id":"technicaldada/hack-winrar","title":"technicaldada/hack-winrar","date":"2019-03-04","url":"https://github.com/technicaldada/hack-winrar"},{"source":"pocgithub","id":"Ektoplasma/ezwinrar","title":"Ektoplasma/ezwinrar","date":"2019-03-05","url":"https://github.com/Ektoplasma/ezwinrar"},{"source":"pocgithub","id":"arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI","title":"arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI","date":"2019-03-08","url":"https://github.com/arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI"},{"source":"pocgithub","id":"AeolusTF/CVE-2018-20250","title":"AeolusTF/CVE-2018-20250","date":"2019-03-11","url":"https://github.com/AeolusTF/CVE-2018-20250"},{"source":"pocgithub","id":"joydragon/Detect-CVE-2018-20250","title":"joydragon/Detect-CVE-2018-20250","date":"2019-03-19","url":"https://github.com/joydragon/Detect-CVE-2018-20250"},{"source":"exploitdb","id":"EDB-46756","title":"RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)","type":"local","platform":"windows","date":"2019-04-25","verified":true,"url":"https://www.exploit-db.com/exploits/46756"},{"source":"pocgithub","id":"likekabin/CVE-2018-20250","title":"likekabin/CVE-2018-20250","date":"2019-04-25","url":"https://github.com/likekabin/CVE-2018-20250"},{"source":"pocgithub","id":"H4xl0r/WinRar_ACE_exploit_CVE-2018-20250","title":"H4xl0r/WinRar_ACE_exploit_CVE-2018-20250","date":"2019-05-16","url":"https://github.com/H4xl0r/WinRar_ACE_exploit_CVE-2018-20250"},{"source":"pocgithub","id":"eastmountyxz/CVE-2018-20250-WinRAR","title":"eastmountyxz/CVE-2018-20250-WinRAR","date":"2020-02-17","url":"https://github.com/eastmountyxz/CVE-2018-20250-WinRAR"},{"source":"pocgithub","id":"lxg5763/cve-2018-20250","title":"lxg5763/cve-2018-20250","date":"2020-05-13","url":"https://github.com/lxg5763/cve-2018-20250"},{"source":"pocgithub","id":"zeronohacker/CVE-2018-20250","title":"zeronohacker/CVE-2018-20250","date":"2021-08-02","url":"https://github.com/zeronohacker/CVE-2018-20250"},{"source":"pocgithub","id":"tzwlhack/CVE-2018-20250","title":"tzwlhack/CVE-2018-20250","date":"2022-03-25","url":"https://github.com/tzwlhack/CVE-2018-20250"},{"source":"pocgithub","id":"tannlh/CVE-2018-20250","title":"tannlh/CVE-2018-20250","date":"2023-12-26","url":"https://github.com/tannlh/CVE-2018-20250"},{"source":"pocgithub","id":"LamSonBinh/CVE-2018-20250","title":"LamSonBinh/CVE-2018-20250","date":"2024-04-26","url":"https://github.com/LamSonBinh/CVE-2018-20250"}],"products":[{"vendor":"check point software technologies ltd.","product":"winrar"},{"vendor":"rarlab","product":"winrar"},{"vendor":"win-rar","product":"winrar"}],"references":[{"url":"https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","tags":["x_refsource_MISC","x_transferred","Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46552/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/106948","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.win-rar.com/whatsnew.html","tags":["x_refsource_MISC","x_transferred","Release Notes"]},{"url":"http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46756/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250"},{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar"},{"url":"https://www.exploit-db.com/exploits/46552"},{"url":"https://www.exploit-db.com/exploits/46756"},{"url":"https://github.com/advisories/GHSA-7v9q-j964-43qc"}],"sources":{"cve":[{"id":"CVE-2018-20250","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","status":"published","published":"2019-02-05T20:00:00Z","modified":"2026-08-13T03:55:27.334Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2018-12813","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","status":"published","published":"2019-02-05T20:00:00Z","modified":"2026-08-13T03:55:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-02-15","updated_at":"2026-11-02T18:01:57.213133Z"}],"ghsa":[{"id":"GHSA-7v9q-j964-43qc","title":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when...","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","status":"published","published":"2022-05-13T01:32:24Z","modified":"2025-10-22T00:32:42Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-36"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2018-20250","title":"WinRAR Absolute Path Traversal Vulnerability","description":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution","cwes":["CWE-36"],"kev":{"date_added":"2022-02-15","due_date":"2022-08-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2018-20250","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","status":"published","published":"2019-02-05T20:29:00.243Z","modified":"2026-08-13T05:17:17.91Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-36","CWE-22"],"updated_at":"2026-11-02T14:04:53.728218Z"}]}}