{"id":"CVE-2018-20250","published":"2019-02-05T20:29:00Z","modified":"2026-08-13T05:17:17Z","title":"WinRAR Absolute Path Traversal Vulnerability","vendor":"RARLAB","product":"WinRAR","tier":"core","eol":null,"description":{"text":"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.","provenance":"source","from":"NVD"},"summary":{"text":"WinRAR (by RARLAB) contains an absolute path traversal flaw in its handling of the filename field in ACE-format archives, implemented in the UNACEV2.dll component, affecting versions up to and including 5.61. When a specially crafted filename is processed, WinRAR ignores the chosen extraction folder and treats the filename as an absolute path, so an attacker who can get a user to open a malicious ACE archive (local access, user interaction required, no authentication) can cause files to be written to arbitrary locations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:15Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96004,"percentile":0.99876,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-02-15","dueDate":"2022-08-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-02-28","exploitedFirstSeen":"2019-02-28","ransomware":true,"evidence":[{"url":"https://cert.gov.ua/article/2695","date":"2019-02-28"},{"url":"https://ti.qianxin.com/blog/articles/apt-c-27-%28goldmouse%29:-suspected-target-attack-against-the-middle-east-with-winrar-exploit-en/","date":"2019-03-19"},{"url":"https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage","date":"2019-03-27"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.csk.gov.in/alerts/STOP_ransomware.html","date":"2020-02-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-15"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://mp.weixin.qq.com/s/hi1YgUUHnFDGf26cUXJkQQ","date":"2023-05-13"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-36","name":"Absolute Path Traversal"}],"references":[{"url":"http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106948","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","tags":["Exploit","Third Party Advisory"]},{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46552/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46756/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.win-rar.com/whatsnew.html","tags":["Release Notes"]},{"url":"http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106948","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","tags":["Exploit","Third Party Advisory"]},{"url":"https://research.checkpoint.com/extracting-code-execution-from-winrar/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46552/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46756/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.win-rar.com/whatsnew.html","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: User opens malicious archive file","mappingType":"uncategorized","evidence":[{"from":"description","quote":"There is path traversal vulnerability when crafting the filename field of the ACE format","start":48,"end":136}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1036","name":"Masquerading","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker-controlled absolute path writes files outside intended folder","mappingType":"primary_impact","evidence":[{"from":"description","quote":"the destination (extraction) folder is ignored, thus treating the filename as an absolute path","start":218,"end":312}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-2b2cfd823e79c61e3f3a","title":"Inside Microsoft 365 Defender: Mapping attack chains from cloud to endpoint","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/","date":"2020-06-18","mentions":[{"quote":"HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying.","start":2592,"end":2810}]},{"id":"SRC-57959e6aff8f01101151","title":"Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.","publisher":"security.com","url":"https://www.security.com/threat-intelligence/elfin-apt33-espionage","date":null,"mentions":[{"quote":"In a recent wave of attacks during February 2019, Elfin attempted to exploit a known vulnerability (CVE-2018-20250) in WinRAR, the widely used file archiving and compression utility capable of creating self-extracting archive files.","start":1708,"end":1940},{"quote":"However, prior to this attempted attack, Symantec had rolled out proactive protection against any attempt to exploit this vulnerability (Exp.CVE-2018-20250).","start":2413,"end":2570},{"quote":"Exp.CVE-2018-20250","start":12187,"end":12205}]},{"id":"SRC-445f08a6cce846dad64f","title":"____________________________________________________________________________________________________","publisher":"clearskysec.com","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf","date":null,"mentions":[{"quote":"10 nvd.nist.gov/vuln/detail/CVE-2018-20250","start":17656,"end":17698},{"quote":"‘SysAid-Documentation’ that contained an exploit of the vulnerability assigned CVE -2018-20250,","start":76610,"end":76705}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-12813","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-12813","exploited":true,"exploitedSince":"2022-02-15","provenance":"source"},"exploits":[{"id":46552,"url":"https://www.exploit-db.com/exploits/46552","title":"WinRAR 5.61 - Path Traversal","type":"local","platform":"windows","date":"2019-02-22","verified":true,"provenance":"source"},{"id":46756,"url":"https://www.exploit-db.com/exploits/46756","title":"RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)","type":"local","platform":"windows","date":"2019-04-25","verified":true,"provenance":"source"},{"id":46756,"url":"https://www.exploit-db.com/exploits/46756","title":"RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)","type":"local","platform":"windows","date":"2019-04-25","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-02-22"},"pocGithub":{"count":13,"skipped":6,"earliest":"2019-02-22","earliestUrl":"https://github.com/WyAtu/CVE-2018-20250","repos":[{"name":"WyAtu/CVE-2018-20250","url":"https://github.com/WyAtu/CVE-2018-20250","stars":493,"created":"2019-02-22"},{"name":"QAX-A-Team/CVE-2018-20250","url":"https://github.com/QAX-A-Team/CVE-2018-20250","stars":26,"created":"2019-02-22"},{"name":"easis/CVE-2018-20250-WinRAR-ACE","url":"https://github.com/easis/CVE-2018-20250-WinRAR-ACE","stars":21,"created":"2019-02-23"},{"name":"arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI","url":"https://github.com/arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI","stars":7,"created":"2019-03-08"},{"name":"STP5940/CVE-2018-20250","url":"https://github.com/STP5940/CVE-2018-20250","stars":2,"created":"2019-02-28"}]},"metasploit":[{"name":"RARLAB WinRAR ACE Format Input Validation Remote Code Execution","module":"exploit/windows/fileformat/winrar_ace","type":"exploit","disclosureDate":"2019-02-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb"}],"first":{"date":"2019-02-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html","https://github.com/blau72/CVE-2018-20250-WinRAR-ACE","https://research.checkpoint.com/extracting-code-execution-from-winrar/","https://www.exploit-db.com/exploits/46552/","https://www.exploit-db.com/exploits/46756/"],"flow":[{"stage":"primary","techniques":["T1036"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-02-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","provenance":"source"},{"date":"2019-02-05","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-02-22, PoC-in-GitHub 2019-02-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb","provenance":"source"},{"date":"2019-02-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cert.gov.ua/article/2695","provenance":"source"},{"date":"2020-06-18","kind":"report","label":"Named in microsoft.com: Inside Microsoft 365 Defender: Mapping attack chains from cloud to endpoint","url":"https://www.microsoft.com/en-us/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/","provenance":"machine"},{"date":"2022-02-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-12813","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1106},"priority":{"score":86.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2800 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 3 Exploit-DB entries; 13 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}