CVE-2018-20250

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

Link	Resource
https://www.win-rar.com/whatsnew.html	Vendor Advisory
http://www.securityfocus.com/bid/106948	Third Party Advisory VDB Entry
https://research.checkpoint.com/extracting-code-execution-from-winrar/	Exploit Third Party Advisory
https://github.com/blau72/CVE-2018-20250-WinRAR-ACE	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/46552/	Exploit VDB Entry
http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace	Third Party Advisory
https://www.exploit-db.com/exploits/46756/	Exploit VDB Entry

Configuration 1

cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*

---

Published : 2019-02-05 08:29

Updated : 2019-10-09 11:39

---

NVD link : CVE-2018-20250

Mitre link : CVE-2018-20250

Rarlab

Winrar

CWE-22