CVE-2018-20250

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in...

Basic Information

CVE State: PUBLISHED
Reserved Date: December 19, 2018
Published Date: February 05, 2019
Last Updated: February 07, 2025
Vendor: Check Point Software Technologies Ltd.
Product: WinRAR
Description: In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

CVSS Scores

CVSS v3.1

7.8 - HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-02-15 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2020-02-17 15:08:22 UTC) Source
Used in Malware: Yes (added 2022-02-15 00:00:00 UTC) Source

References

https://github.com/blau72/CVE-2018-20250-WinRAR-ACE https://research.checkpoint.com/extracting-code-execution-from-winrar/ https://www.exploit-db.com/exploits/46552/ http://www.securityfocus.com/bid/106948 https://www.win-rar.com/whatsnew.html http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace https://www.exploit-db.com/exploits/46756/

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-02-15 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_ace.rb	2025-04-29 11:01:36 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

winrar_ace

Type: metasploit • Created: Unknown

Metasploit module for CVE-2018-20250

LamSonBinh/CVE-2018-20250

Type: github • Created: 2024-04-26 01:18:45 UTC • Stars: 0

tannlh/CVE-2018-20250

Type: github • Created: 2023-12-26 11:01:32 UTC • Stars: 0

tzwlhack/CVE-2018-20250

Type: github • Created: 2022-03-25 13:02:41 UTC • Stars: 0

zeronohacker/CVE-2018-20250

Type: github • Created: 2021-08-02 01:24:01 UTC • Stars: 0

CVE-2018-20250

eastmountyxz/CVE-2018-20250-WinRAR

Type: github • Created: 2020-02-17 15:08:22 UTC • Stars: 1

这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，复现了该漏洞和理解恶意软件自启动劫持原理。作为网络安全初学者，自己确实很菜，但希望坚持下去，一起加油！

H4xl0r/WinRar_ACE_exploit_CVE-2018-20250

Type: github • Created: 2019-05-16 20:21:50 UTC • Stars: 0

This program is an script developed in Python which exploit the ACE vulnerability on WinRar - Vulnerability CVE-2018-20250

likekabin/CVE-2018-20250

Type: github • Created: 2019-04-25 02:30:50 UTC • Stars: 0

joydragon/Detect-CVE-2018-20250

Type: github • Created: 2019-03-19 14:51:52 UTC • Stars: 0

Herramienta para revisar si es que un payload tiene componente malicioso de acuerdo a CVE-2018-20250

AeolusTF/CVE-2018-20250

Type: github • Created: 2019-03-11 07:33:45 UTC • Stars: 0

arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI

Type: github • Created: 2019-03-08 12:27:12 UTC • Stars: 7

CVE-2018-20250-WINRAR-ACE Exploit with a UI

STP5940/CVE-2018-20250

Type: github • Created: 2019-02-28 17:07:52 UTC • Stars: 2

easis/CVE-2018-20250-WinRAR-ACE

Type: github • Created: 2019-02-23 01:20:34 UTC • Stars: 21

Proof of concept code in C# to exploit the WinRAR ACE file extraction path (CVE-2018-20250).

blunden/UNACEV2.DLL-CVE-2018-20250

Type: github • Created: 2019-02-22 14:19:20 UTC • Stars: 0

A version of the binary patched to address CVE-2018-20250

nmweizi/CVE-2018-20250-poc-winrar

Type: github • Created: 2019-02-22 13:18:14 UTC • Stars: 0

QAX-A-Team/CVE-2018-20250

Type: github • Created: 2019-02-22 06:47:01 UTC • Stars: 25

010 Editor template for ACE archive format & CVE-2018-2025[0-3]

WyAtu/CVE-2018-20250

Type: github • Created: 2019-02-22 04:52:08 UTC • Stars: 489

exp for https://research.checkpoint.com/extracting-code-execution-from-winrar