CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
- Published
- Feb 5, 2019
- Updated
- Aug 13, 2026
- Assigning CNA
- checkpoint
- Evidence observed
- Feb 22, 2019
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 16, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Sources
modules/exploits/windows/fileformat/winrar_ace.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/fileformat/winrar_ace.platform)
- verification: check_not_declared($.exploit_windows/fileformat/winrar_ace.check)
- CVE-2018-20250Exploit
Generates malicious RAR archives automatically to exploit CVE-2018-20250 and achieve code execution via WinRAR ACE path traversal.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.