In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (i…

published 2019-02-05 7 y ago modified 2026-08-13 2 mo ago also EUVD-2018-12813

cvss: 7.8; version 3.1, CNA
cisa kev: Exploited; added 2022-02-15, used in ransomware
epss: 96.0%; EPSS 96.0% chance of exploitation in 30 days, percentile 99.8%
public exploits: 3; Metasploit, Exploit-DB

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

2019-02-05 First public exploit (Metasploit exploit/windows/fileformat/winrar_ace)
2019-02-05 Published
2022-02-14 CISA SSVC: exploitation active
2022-02-15 Added to CISA KEV
2022-08-15 CISA patch deadline

Known exploited

Added: 4 y ago (2022-02-15)
Patch by: 2022-08-15 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: RARLAB, WinRAR
CISA name: WinRAR Absolute Path Traversal Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 4 y ago (2022-02-14)

Exploit prediction

96.00% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/fileformat/winrar_ace RARLAB WinRAR ACE Format Input Validation Remote Code Execution metasploit exploit, excellent rank, 2019-02-05
EDB-46756 RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit) local, 2019-04-25
EDB-46552 WinRAR 5.61 - Path Traversal local, 2019-02-22
github.com https://github.com/blau72/CVE-2018-20250-WinRAR-ACE referenced PoC, tagged "exploit" by a source, unverified
research.checkpoint.com https://research.checkpoint.com/extracting-code-execution-from-winrar/ referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Check Point Software Technologies Ltd. WinRAR

Classification

Weakness

CWE-36 Absolute Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

exploit-db.com /exploits/46552/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/46756/
exploit, third-party-advisory, vdb-entry
github.com /blau72/CVE-2018-20250-WinRAR-ACE
exploit, third-party-advisory
research.checkpoint.com /extracting-code-execution-from-winrar/
exploit, press/media-coverage, third-party-advisory
packetstormsecurity.com /files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/106948
vdb-entry, broken-link, third-party-advisory
win-rar.com /whatsnew.html
release-notes
rapid7.com /db/modules/exploit/windows/fileformat/winrar_ace
third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
government-resource, us-government-resource

Sources

CVE List CVE-2018-20250
NVD CVE-2018-20250

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary