In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll)
Why It Matters
Analysis dossierWhy It Matters
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Immediate Attention
Yes
Unknown
Risk basis: CISA KEV exploitation signal; Microsoft or Microsoft-managed product relevance; HIGH severity; Source-confirmed exploitation or CISA KEV/ransomware metadata
Affected Products & Remediation
1 source-backed product- rarlab winrar · <= 5.61 · NVD CPE · Source
Vendor or catalog guidance (source)
- CISA KEV: Apply updates per vendor instructions.
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Listed
- Exploited (source statement)
- Yes
- Publicly disclosed (source)
- Unknown
CISA required action: Apply updates per vendor instructions.
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched path-traversal (CWE-22)
Exposure
- Locate affected deployments and the path-handling endpoint named by the advisory.Telemetry: Application access logs · The affected path must come from the source, not the CWE alone. · Rule path-traversal
Exploitation evidence
- Review requests to that endpoint for traversal encodings and unusual file responses.Telemetry: Application access logs · Such patterns are a hypothesis to validate against normal traffic. · Rule path-traversal
Response
- Verify the source-stated fix and retest the affected path.Telemetry: Application change records · The exact remediation depends on the source advisory. · Rule path-traversal
CISA KEV Record
Apply updates per vendor instructions.
Change History & Source Data
— No recorded material change
- CNA / source
- cve@checkpoint.com
- Record status · verification
- UPDATED · CISA KEV confirmed
- CPE
- cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2018-20250"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…