CVE-2018-20251
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2018-20251. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.
Available Exploits
Related News
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: May 13, 2022, Modified: May 13, 2022