CVE-2018-20250: WinRAR ACE filename path traversal enables arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and public exploits exist, making it a high-risk, actively exploited vulnerability.

What it is

WinRAR versions up to and including 5.61 mishandle the filename field in ACE archives processed by UNACEV2.dll, allowing a crafted filename to be treated as an absolute path and ignoring the chosen extraction folder. This lets an attacker write files to arbitrary locations on the victim's system when the archive is extracted.

Impact

An attacker can write files outside the intended extraction directory, which can lead to code execution in the context of the user who extracts the archive. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The flaw is reached locally when a user extracts a malicious ACE archive with WinRAR; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No remote network access is needed beyond delivering the archive file.

Exploitation

CISA KEV lists this as known exploited with ransomware campaign use, and EPSS is 0.96274 (99.877th percentile). Multiple public exploit references exist, confirming active exploitation.

What to do

• Update WinRAR to a version after 5.61 as directed by the vendor.
• Remove or disable the legacy UNACEV2.dll if it cannot be updated immediately.
• Block or scan ACE archives at email and web gateways where feasible.
• Educate users not to extract untrusted ACE archives.
• Apply the CISA KEV required action per vendor instructions.

Detection

• Monitor for file creation events in unexpected system directories (e.g., Startup folders) originating from archive extraction processes.
• Alert on WinRAR or UNACEV2.dll loading ACE files from untrusted sources.
• Search for known exploit filenames or paths associated with public PoCs.
• Review endpoint logs for suspicious child processes spawned by WinRAR.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.