---
id: CVE-2018-20250
title: >-
  In WinRAR versions prior to and including 5.61, There is path traversal
  vulnerability when crafting the filename field of the ACE format (in
  UNACEV2.dll)
summary: >-
  In WinRAR versions prior to and including 5.61, There is path traversal
  vulnerability when crafting the filename field of the ACE format (in
  UNACEV2.dll). When the filename field is manipulated with specific patterns,
  the destination (ex…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-36
  - CWE-22
vendor: rarlab
product: winrar
affected:
  - winrar <= 5.61
published: '2019-02-05'
updated: '2026-08-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-20250'
references:
  - url: >-
      http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
    label: cve@checkpoint.com
  - url: 'http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace'
    label: cve@checkpoint.com
  - url: 'http://www.securityfocus.com/bid/106948'
    label: cve@checkpoint.com
  - url: 'https://github.com/blau72/CVE-2018-20250-WinRAR-ACE'
    label: cve@checkpoint.com
  - url: 'https://research.checkpoint.com/extracting-code-execution-from-winrar/'
    label: cve@checkpoint.com
  - url: 'https://www.exploit-db.com/exploits/46552/'
    label: cve@checkpoint.com
  - url: 'https://www.exploit-db.com/exploits/46756/'
    label: cve@checkpoint.com
  - url: 'https://www.win-rar.com/whatsnew.html'
    label: cve@checkpoint.com
  - url: >-
      http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/106948'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/blau72/CVE-2018-20250-WinRAR-ACE'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://research.checkpoint.com/extracting-code-execution-from-winrar/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.exploit-db.com/exploits/46552/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.exploit-db.com/exploits/46756/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.win-rar.com/whatsnew.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.96274
epssPercentile: 0.99879
kev: true
kevDateAdded: '2022-02-15'
kevDueDate: '2022-08-15'
kevRansomware: true
exploited: true
exploitAvailable: true
ingestedAt: '2026-08-13T06:00:54.876Z'
exploits:
  exploitdb: true
  github: 19
  githubRepos:
    - 'https://github.com/WyAtu/CVE-2018-20250'
    - 'https://github.com/QAX-A-Team/CVE-2018-20250'
    - 'https://github.com/nmweizi/CVE-2018-20250-poc-winrar'
  metasploit:
    - exploit/windows/fileformat/winrar_ace
  checkedAt: '2026-09-21T15:23:39.554Z'
---

## Overview

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

## Affected

- `winrar <= 5.61`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.