CVE-2018-20251
mediumpriority · track · 33EPSS 0.314 · 98 %ileEURUUSEPSS · scored 2026-10-27
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.4
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- http://www.rarsoft.com/cnnvd
- http://www.securityfocus.com/bid/106948cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2018-20251cnnvd
- https://research.checkpoint.com/extracting-code-execution-from-winrar/cnnvd
- https://www.securityfocus.com/bid/106948cnnvd
- https://www.win-rar.com/whatsnew.htmlcnnvd
- https://www.win-rar.com/whatsnew.html?&L=0Patchcnnvd
- http://www.securityfocus.com/bid/106948enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan