CVE-2018-20250
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Analysis
WinRAR before 5.61 contains a path traversal vulnerability in the ACE archive format handler (UNACEV2.dll) that allows extraction of files to arbitrary locations, enabling persistent malware installation through Startup folder placement.
Technical Context
The CWE-36 path traversal in UNACEV2.dll occurs when parsing the filename field of ACE format archives. By manipulating the filename with traversal sequences, attackers can write files to any writable location. The classic attack writes a malicious executable to the Windows Startup folder for persistence.
Affected Products
['WinRAR versions prior to and including 5.61']
Remediation
Update WinRAR to 5.70+ which removed ACE format support entirely (UNACEV2.dll deleted). The DLL cannot be patched as source code was lost. Alternatively, manually delete UNACEV2.dll from WinRAR installation directory.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today