CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
CVSS
7.8
High
EPSS
96.0%
p100
KEV
YES
Feb 15, 2022
Exploit Today
80
0-100
Published: Feb 5, 2019 · Last modified: Aug 13, 2026 · CWE-36 · CWE-22
96.0%EPSS · 30 days96.3%
2026-09-162026-10-14
Product
RARLAB / WinRAR
Vulnerability
WinRAR Absolute Path Traversal Vulnerability
Added to KEV
Feb 15, 2022
Remediate by
Aug 15, 2022
Known ransomware use
Yes
Summary description
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-41544——
———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later6hCVE-2026-24718——
———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.7 and later
Qsync Central 5.1.0.3 and later
Qsync Central 5.2.0.5 and later
Qsync Central 5.3.0.2 and later6hCVE-2025-66275——
———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later6hCVE-2025-66272——
———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later6hCVE-2026-1109236.5 MED—
———A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.7hCVE-2026-626645.4 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.16h