Detections
Analytics
CVE-2018-20250
high
Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
From the Tenable Blog
WinRAR Absolute Path Traversal Vulnerability Leads to Remote Code Execution (CVE-2018-20250)
Published: 2019-02-25
A 19-year-old vulnerability in WinRAR’s ACE file format support (CVE-2018-20250) has been identified as part of an attack in the wild.
References
https://www.win-rar.com/whatsnew.html
https://www.exploit-db.com/exploits/46756/
https://www.exploit-db.com/exploits/46552/
https://research.checkpoint.com/extracting-code-execution-from-winrar/
https://github.com/blau72/CVE-2018-20250-WinRAR-ACE