---
id: "CVE-2018-20250"
kind: "vulnerability"
aliases: ["CVE-2018-20250"]
title: "RARLAB WinRAR: WinRAR Absolute Path Traversal Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.96004
exploited: true
status: "open"
category: "other"
products: [{"name": "RARLAB WinRAR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "ransomware", "windows", "winrar"]
not_affected_if: ["no-winrar-installed"]
published_at: "2019-02-05T20:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-20250", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-20250", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20250", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# RARLAB WinRAR: WinRAR Absolute Path Traversal Vulnerability

WinRAR fails to sanitize absolute paths in archive entries, so a crafted archive can write files outside the extraction folder. The sources say this leads to remote code execution, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RARLAB WinRAR affected ? fixed ?

## How to check

Run WinRAR and check Help > About WinRAR for the installed version; unknown whether any other check applies.

## Fix

Update WinRAR to a fixed release per vendor instructions; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-20250
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-20250
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-20250

## From the sources

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_