{"schemaVersion":3,"id":"CVE-2018-20250","aliases":[],"status":"published","duplicateOf":null,"title":"WinRAR Absolute Path Traversal Vulnerability","description":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","dates":{"published":"2019-02-05T20:00:00.000Z","modified":"2026-08-13T03:55:27.334Z","reserved":null,"kevAdded":["2022-02-15T00:00:00.000Z"],"kevDue":["2022-08-15T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.96004,"percentile":0.99878,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.27000000000000357,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.96274},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96004,"percentile":0.99878}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96274,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96004,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96004,"percentile":0.99878}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-02-15T00:00:00.000Z","dueDate":"2022-08-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"WinRAR Absolute Path Traversal Vulnerability","description":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","label":"nvd.nist.gov/vuln/detail/CVE-2018-20250"}],"vendor":"RARLAB","product":"WinRAR","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-02-15T00:00:00.000Z","dueDate":"2022-08-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"WinRAR Absolute Path Traversal Vulnerability","description":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","label":"nvd.nist.gov/vuln/detail/CVE-2018-20250"}],"vendor":"RARLAB","product":"WinRAR","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"GITHUB_BLAU72_CVE-2018-20250-WINRAR-ACE","name":"Cve 2018 20250 Winrar Ace","source":"github","url":"https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_263B1988B5868DEC","name":"Exploit Reference (research.checkpoint.com)","source":"reference","url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_420DB61143334A7D","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"46756","name":"RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/46756","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/46756.rb","codes":["CVE-2018-20250"]},"metasploit":null},{"id":"46552","name":"WinRAR 5.61 - Path Traversal","source":"exploit-database","url":"https://www.exploit-db.com/exploits/46552","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/46552.py","codes":["CVE-2018-20250"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_FILEFORMAT_WINRAR_ACE","name":"RARLAB WinRAR ACE Format Input Validation Remote Code Execution","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/fileformat/winrar_ace.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/fileformat/winrar_ace","rank":"600","rankName":"excellent","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":6,"weaknesses":[{"id":"CWE-36","name":"Absolute Path Traversal","description":"The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as \"/abs/path\" that can resolve to a location that is outside of that directory.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/36.html"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"check point software technologies ltd.","product":"winrar","name":"WinRAR","label":"winrar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions prior and including 5.61","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions prior and including 5.61","eol":null,"hubHref":"/vendor/check_point_software_technologies_ltd/winrar"},{"vendor":"rarlab","product":"winrar","name":"WinRAR","label":"winrar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.61","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.61","eol":null,"hubHref":"/vendor/rarlab/winrar"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","label":"github.com/blau72/CVE-2018-20250-WinRAR-ACE","hostname":"github.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","label":"research.checkpoint.com/extracting-code-execution-from-winrar/","hostname":"research.checkpoint.com","tags":["X Refsource MISC","Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46552/","label":"www.exploit-db.com/exploits/46552/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/106948","label":"www.securityfocus.com/bid/106948","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://www.win-rar.com/whatsnew.html","label":"www.win-rar.com/whatsnew.html","hostname":"www.win-rar.com","tags":["X Refsource MISC","Release Notes"]},{"url":"http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace","label":"www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace","hostname":"www.rapid7.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46756/","label":"www.exploit-db.com/exploits/46756/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-02-05T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-02-15T00:00:00.000Z","label":"Added to CISA KEV","detail":"WinRAR Absolute Path Traversal Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-08-15T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-13T03:55:27.334Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:04:36.361Z","stale":false,"partial":false}}