CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
CVSS
7.8
Alto
EPSS
96.0%
p100
KEV
SÍ
15 feb 2022
Exploit Today
80
0-100
Publicado: 5 feb 2019 · Última mod.: 13 ago 2026 · CWE-36 · CWE-22
96.0%EPSS · 30 días96.3%
2026-09-162026-10-14
Producto
RARLAB / WinRAR
Vulnerabilidad
WinRAR Absolute Path Traversal Vulnerability
Añadido a KEV
15 feb 2022
Remediar antes de
15 ago 2022
Uso conocido en ransomware
Sí
Descripción resumida
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
Acción requerida
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- packetstormsecurity.comhttp://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- www.rapid7.comhttp://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- www.securityfocus.comhttp://www.securityfocus.com/bid/106948
- github.comhttps://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- research.checkpoint.comhttps://research.checkpoint.com/extracting-code-execution-from-winrar/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46552/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/46756/
- www.win-rar.comhttps://www.win-rar.com/whatsnew.html
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-41544——
———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later6hCVE-2026-24718——
———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.7 and later
Qsync Central 5.1.0.3 and later
Qsync Central 5.2.0.5 and later
Qsync Central 5.3.0.2 and later6hCVE-2025-66275——
———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later6hCVE-2025-66272——
———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later6hCVE-2026-1109236.5 MED—
———A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.7hCVE-2026-626645.4 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.16h