Actively exploited in the wild
WinRAR Absolute Path Traversal Vulnerability
RARLAB - WinRAR · Listed in the CISA KEV since 2022-02-15. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-20250
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Risk Assessment
An attacker can cause files to be extracted outside the intended directory, potentially leading to overwriting critical system files or executing malicious code.
Recommendation
Update WinRAR to a version newer than 5.61 that includes the fix for this vulnerability.
Original NVD description (English source)
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.