In WinRAR CVE-2018-20250
HIGHCVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
AnalysisAI
WinRAR before 5.61 contains a path traversal vulnerability in the ACE archive format handler (UNACEV2.dll) that allows extraction of files to arbitrary locations, enabling persistent malware installation through Startup folder placement.
Technical ContextAI
The CWE-36 path traversal in UNACEV2.dll occurs when parsing the filename field of ACE format archives. By manipulating the filename with traversal sequences, attackers can write files to any writable location. The classic attack writes a malicious executable to the Windows Startup folder for persistence.
Affected ProductsAI
WinRAR versions prior to and including 5.61
RemediationAI
Update WinRAR to 5.70+ which removed ACE format support entirely (UNACEV2.dll deleted). The DLL cannot be patched as source code was lost. Alternatively, manually delete UNACEV2.dll from WinRAR installation directory.
Share
External POC / Exploit Code
Leaving vuln.today