{"id":"CVE-2018-20250","kind":"vulnerability","aliases":["CVE-2018-20250"],"related":[],"title":"RARLAB WinRAR: WinRAR Absolute Path Traversal Vulnerability","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","summary":"WinRAR fails to sanitize absolute paths in archive entries, so a crafted archive can write files outside the extraction folder. The sources say this leads to remote code execution, and CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":0.96004,"exploited":true,"exploited_at":"2022-02-15T00:00:00+00:00","products":[{"name":"RARLAB WinRAR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","other","ransomware","windows","winrar"],"not_affected_if":["no-winrar-installed"],"how_to_check":"Run WinRAR and check Help > About WinRAR for the installed version; unknown whether any other check applies.","fix":"Update WinRAR to a fixed release per vendor instructions; the fixed version is unknown from the sources.","status":"open","published_at":"2019-02-05T20:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:36+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:26:36Z","model":"claude-haiku-5-5","output":{"fix":"Update WinRAR to a fixed release per vendor instructions; the fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"WinRAR fails to sanitize absolute paths in archive entries, so a crafted archive can write files outside the extraction folder. The sources say this leads to remote code execution, and CISA lists it as actively exploited.","category":"other","who_cares":["windows","winrar"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker plants executable files via crafted archive, achieving code execution on the machine.","analyst_note":"Confirm the fixed WinRAR version and the exact user-interaction requirement from the NVD or vendor advisory at https://www.rarlab.com; the sources do not name them.","how_to_check":"Run WinRAR and check Help > About WinRAR for the installed version; unknown whether any other check applies.","needs_analyst":true,"not_affected_if":["no-winrar-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2817,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':9A,12A '-20250':10A,13A '5.61':64C 'absolut':4A,25B,102C 'ace':77C 'activ':55B 'archiv':28B,33B 'cisa':51B 'code':48B 'craft':32B,71C 'cve':8A,11A 'destin':91C 'entri':29B 'execut':49B 'exploit':16B,56B 'extract':39B,92C 'fail':22B 'field':74C,84C 'file':36B 'filenam':73C,83C,99C 'folder':40B,93C 'format':78C 'ignor':95C 'includ':63C 'lead':45B 'list':52B 'manipul':86C 'outsid':37B 'path':5A,26B,67C,103C 'pattern':89C 'prior':60C 'ransomwar':18B 'rarlab':1A,14A 'remot':47B 'sanit':24B 'say':43B 'sourc':42B 'specif':88C 'thus':96C 'travers':6A,68C 'treat':97C 'unacev2.dll':80C 'version':59C 'vulner':7A,69C 'window':19B 'winrar':2A,3A,15A,20B,21B,58C 'write':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-02-05T20:29:00+00:00","kev":{"dateAdded":"2022-02-15","dueDate":"2022-08-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-20250","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-20250","severity":null,"published_at":"2022-02-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2018-20250","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20250","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-20250","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","severity":null,"published_at":"2019-02-05T20:29:00+00:00","modified_at":"2026-08-13T05:17:17+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}