CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
CVSS
7.8
High
EPSS
96.3%
p100
KEV
YES
Feb 15, 2022
Exploit Today
80
0-100
Published: Feb 5, 2019 · Last modified: Aug 13, 2026 · CWE-36 · CWE-22
96.3%EPSS · 30 days96.3%
2026-08-022026-08-30
Product
RARLAB / WinRAR
Vulnerability
WinRAR Absolute Path Traversal Vulnerability
Added to KEV
Feb 15, 2022
Remediate by
Aug 15, 2022
Known ransomware use
Yes
Summary description
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-82673——
———Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.3hCVE-2026-826035.4 MED—
———A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.4hCVE-2026-825995.4 MED—
———A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.5hCVE-2026-567187.5 HIG—
———AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.9hCVE-2026-826562.6 LOW—
——0Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.15hCVE-2026-826358.8 HIG—
——0Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.17h