{"schemaVersion":3,"id":"CVE-2018-20251","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.","dates":{"published":"2019-02-05T20:00:00.000Z","modified":"2024-09-16T21:04:19.182Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.31404,"percentile":0.98271,"severity":"high","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.12400000000000189,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.31528},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06273,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.31404,"percentile":0.98271}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06273,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.31528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.31404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.31404,"percentile":0.98271}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_263B1988B5868DEC","name":"Exploit Reference (research.checkpoint.com)","source":"reference","url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-693","name":"Protection Mechanism Failure","description":"The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.","type":"weakness","status":"Draft","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/693.html"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"check point software technologies ltd.","product":"winrar","name":"WinRAR","label":"winrar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions prior and including 5.61","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions prior and including 5.61","eol":null,"hubHref":"/vendor/check_point_software_technologies_ltd/winrar"},{"vendor":"rarlab","product":"winrar","name":"WinRAR","label":"winrar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.61","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.61","eol":null,"hubHref":"/vendor/rarlab/winrar"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","label":"research.checkpoint.com/extracting-code-execution-from-winrar/","hostname":"research.checkpoint.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106948","label":"www.securityfocus.com/bid/106948","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.win-rar.com/whatsnew.html","label":"www.win-rar.com/whatsnew.html","hostname":"www.win-rar.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-02-05T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T21:04:19.182Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":38,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:29:08.648Z","stale":false,"partial":false}}