CVE-2018-20250

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 96.00%
EPSS Percentile: 99.88%
CISA KEV: YES — Known Exploited Vulnerability

Description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@checkpoint.com
Published: 06-Feb-2019 03:29
Last Modified: 13-Aug-2026 12:17
EPSS Date: 2026-10-12
CWE: CWE-36, CWE-22

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-02-15
Remediation Due: 2022-08-15
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-20250

Affected Products / Versions

rarlab / winrar
Version / affected range: * · through (inclusive) 5.61
cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 00:18
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2018-20250, a WinRAR vulnerability from 2018, was still being exploited in targeted attacks years after its disclosure. Russia-Aligned Groups Exploit Unpatched WinRAR Flaw in Campaigns Against Ukraine

CVE (2)

Malware (1)

People (2)

Threat Actors (14)

MITRE ATT&CK (17)

Vendors (2)

Products (5)

Tools (1)

Industries (3)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.