CVE-2018-20250

Confirmed PUBLISHED

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in...

Check Point Software Technologies Ltd. · WinRAR

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.8 High

At a Glance

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

cisa malware ransomware metasploit windows

CVE Published: Feb 05, 2019
Exploitation Reported: Feb 15, 2022
CVSS: 7.8 High
EPSS: —

Low complexity Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Check Point Software Technologies Ltd.	WinRAR	All versions prior and including 5.61	Affected

CVE References

46552 exploit-db.com · Exploit https://www.exploit-db.com/exploits/46552/
46756 exploit-db.com · Exploit https://www.exploit-db.com/exploits/46756/
106948 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/106948
GitHub — blau72/CVE-2018-20250-WinRAR-ACE github.com · CVE Record https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
research.checkpoint.com/extracting-code-execution-from-winrar research.checkpoint.com · CVE Record https://research.checkpoint.com/extracting-code-execution-from-winrar/

Show 3 more references

win-rar.com/whatsnew.html win-rar.com · CVE Record https://www.win-rar.com/whatsnew.html
packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-...
rapid7.com/db/modules/exploit/windows/fileformat/winrar... rapid7.com · CVE Record http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-02-15 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2022-02-15 00:00:00 UTC · CISA

Used in malware

Recorded 2022-02-15 00:00:00 UTC · CISA

Proof of concept available

Recorded 2019-02-22 04:52:08 UTC · GitHub

Weaknesses (CWE)

CWE-36

Absolute Path Traversal

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

LamSonBinh/CVE-2018-20250

github · Created 2024-04-26 01:18:45 UTC · 0 stars

tannlh/CVE-2018-20250

github · Created 2023-12-26 11:01:32 UTC · 0 stars

tzwlhack/CVE-2018-20250

github · Created 2022-03-25 13:02:41 UTC · 0 stars

zeronohacker/CVE-2018-20250

github · Created 2021-08-02 01:24:01 UTC · 0 stars

CVE-2018-20250

eastmountyxz/CVE-2018-20250-WinRAR

github · Created 2020-02-17 15:08:22 UTC · 1 stars

这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，复现了该漏洞和理解恶意软件自启动劫持原理。作为网络安全初学者，自己确实很菜，但希望坚持下去，一起加油！

H4xl0r/WinRar_ACE_exploit_CVE-2018-20250

github · Created 2019-05-16 20:21:50 UTC · 0 stars

This program is an script developed in Python which exploit the ACE vulnerability on WinRar - Vulnerability CVE-2018-20250

likekabin/CVE-2018-20250

github · Created 2019-04-25 02:30:50 UTC · 0 stars

joydragon/Detect-CVE-2018-20250

github · Created 2019-03-19 14:51:52 UTC · 0 stars

Herramienta para revisar si es que un payload tiene componente malicioso de acuerdo a CVE-2018-20250

AeolusTF/CVE-2018-20250

github · Created 2019-03-11 07:33:45 UTC · 0 stars

arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI

github · Created 2019-03-08 12:27:12 UTC · 7 stars

CVE-2018-20250-WINRAR-ACE Exploit with a UI

STP5940/CVE-2018-20250

github · Created 2019-02-28 17:07:52 UTC · 2 stars

easis/CVE-2018-20250-WinRAR-ACE

github · Created 2019-02-23 01:20:34 UTC · 21 stars

Proof of concept code in C# to exploit the WinRAR ACE file extraction path (CVE-2018-20250).

blunden/UNACEV2.DLL-CVE-2018-20250

github · Created 2019-02-22 14:19:20 UTC · 0 stars

A version of the binary patched to address CVE-2018-20250

nmweizi/CVE-2018-20250-poc-winrar

github · Created 2019-02-22 13:18:14 UTC · 0 stars

QAX-A-Team/CVE-2018-20250

github · Created 2019-02-22 06:47:01 UTC · 25 stars

010 Editor template for ACE archive format & CVE-2018-2025[0-3]

WyAtu/CVE-2018-20250

github · Created 2019-02-22 04:52:08 UTC · 489 stars

exp for https://research.checkpoint.com/extracting-code-execution-from-winrar

winrar_ace

metasploit · Created Unknown

Metasploit module for CVE-2018-20250

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2018-20250

{
  "cve_id": "CVE-2018-20250",
  "title": "In WinRAR versions prior to and including 5.61, There is path traversal vulne...",
  "affected_vendor": "Check Point Software Technologies Ltd.",
  "affected_product": "WinRAR",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2018-20250

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API