CVE-2018-20251

Think of WinRAR like a box-unwrapper that reads a label from inside a packed file. In older WinRAR versions (up to 5.61), a malicious label in an ACE archive can contain “tricks” that point outside the intended extraction folder. The result is that WinRAR may create empty files and folders in places it shouldn’t—causing disruption and leaving unwanted leftovers behind.

This matters if you use or run WinRAR to open or extract ACE archives on your business computers. The risk is specifically tied to extracting a maliciously crafted ACE file that triggers the path traversal behavior in WinRAR’s UNACE module. Based on the information provided, this is a concern when the attacker’s file is delivered to you (for example via email downloads or shared files) and you extract it using WinRAR.

This should be treated as a priority update because the likelihood of this being attempted is rising. While it’s not confirmed in the CISA KEV catalog and there’s no public exploit code on record, the flaw can be triggered just by extracting a malicious ACE archive and can still cause unwanted filesystem changes.

1. Inventory and verify

   • Identify every machine where WinRAR is installed.
   • Record the exact WinRAR version number.

2. Confirm exposure

   • You are exposed if your WinRAR version is prior to and including 5.61.

3. Upgrade to the vendor-fixed version

   • Upgrade WinRAR to version 5.70 Beta 1 (per vendor remediation).
   • After upgrading, re-check the installed version number to confirm the update took effect.

4. If you cannot upgrade immediately (workarounds)

   • Avoid extracting ACE archives from unknown or untrusted sources.
   • Treat unexpected attachments or downloaded archives as untrusted until verified.
   • Prefer extracting using a controlled environment (for example, a dedicated test machine) if you must handle untrusted ACE files.

5. What to monitor after handling suspect files

   • Check for newly created empty files/folders in unusual locations around the time of extraction.
   • If you find unexpected entries, remove them and review what archive was extracted.

6. Timing

   • No CISA KEV due date applies because this CVE is not listed in CISA KEV (based on the findings provided).

Severity is effectively moderate (based on the provided CVSS 5.5) and the key issue is path traversal in ACE extraction. In WinRAR versions prior to and including 5.61, the UNACE module (UNACEV2.dll) can create filesystem entries based on the crafted ACE “filename” field even when WinRAR detects the traversal attempt and aborts extraction. Because the cancellation happens after directories and files are created (but before writing file contents), the attacker’s impact is primarily the creation of empty files and folders in unintended locations.

Findings indicate:

• No entry in CISA KEV (so confirmed exploitation via that channel is not established here).
• No public exploit code on record.
• Predicted exploitation likelihood is rising (do not treat the percentage as confirmation).

CWE mapping from the description:

• CWE-693 (path traversal)
• CWE-22 (improper limitation of a path traversal concern)

Attack vector (from the description and behavior): extracting a maliciously crafted ACE archive; no login requirement is implied by the provided description, but reachability depends on the user handling the attacker-supplied archive in WinRAR.