Security readout for executives and security teams
Plain-English summary
A malicious ACE archive can make WinRAR 5.61 or earlier place extracted files outside the folder selected by the user. This can compromise confidentiality, integrity, and availability when a user opens an untrusted archive. CISA lists the vulnerability as known exploited, making legacy installations an urgent remediation target.
Executive priority
Treat as a high-priority endpoint remediation because exploitation is documented and successful abuse can produce complete confidentiality, integrity, and availability impacts. Focus first on users handling external archives. Track inventory coverage and verified upgrades rather than relying solely on user awareness.
Technical view
UNACEV2.dll improperly handles crafted ACE filename fields containing path-manipulation patterns. WinRAR may ignore the intended extraction directory and interpret the filename as an absolute path, enabling writes elsewhere with the user’s permissions. Exploitation requires user interaction and has low complexity; the supplied CVSS 3.1 score is 7.8.
Likely exposure
Exposure exists wherever WinRAR 5.61 or earlier remains installed and users can extract untrusted ACE archives. Internet-facing services are not required; email attachments, downloads, and transferred archives are plausible delivery paths. The source bundle does not quantify deployment prevalence.
Exploitation context
CISA KEV inclusion supports real-world exploitation. Public exploit references also exist in the source bundle. Exploitation requires a user to process a crafted archive, but requires no prior attacker privileges. This assessment does not establish the current frequency, targeting, or campaign scope.
Researcher notes
The core primitive is an archive filename path traversal resulting in an arbitrary-location write constrained by the extracting user’s permissions. The supplied evidence identifies UNACEV2.dll and ACE processing. It does not provide enough information to characterize every reachable destination, security-control bypass, campaign, or post-exploitation behavior.
Mitigation direction
- Inventory WinRAR installations and prioritize versions 5.61 or earlier.
- Upgrade affected installations following current WinRAR vendor guidance.
- Remove unsupported legacy installations where upgrading is impractical.
- Restrict or quarantine untrusted ACE archives until remediation is complete.
- Review endpoint protections for malicious archive delivery and unexpected file writes.
Validation and detection
- Confirm the installed WinRAR version on every managed endpoint.
- Verify no installations remain at version 5.61 or earlier.
- Confirm upgraded systems follow the vendor’s current supported configuration.
- Search security telemetry for suspicious archive extraction and unexpected file creation.
- Use non-weaponized regression testing to confirm extraction remains within the selected directory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-36: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-20250 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2018-20250 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2022-02-15T00:00:00.000Z: CVE-2018-20250 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACECVE reference, checkpoint · x_refsource_MISC
- https://research.checkpoint.com/extracting-code-execution-from-winrar/CVE reference, checkpoint · x_refsource_MISC
- 46552CVE reference, checkpoint · exploit, x_refsource_EXPLOIT-DB
- https://www.win-rar.com/whatsnew.htmlCVE reference, checkpoint · x_refsource_MISC
- 46756CVE reference, checkpoint · exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20250CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Absolute Path Traversal
Absolute Path Traversal represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.