CVE-2018-20250 Known ransomware use

WinRAR Absolute Path Traversal Vulnerability

RARLAB — WinRAR

Added to KEV catalog: 15 February 2022
Federal remediation due date: 15 August 2022
Weakness classification (CWE): CWE-36

CISA Description

WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-20250

View on NVD View on MITRE CVE View full CISA catalog

More RARLAB Vulnerabilities

CVE-2025-6218

RARLAB WinRAR Path Traversal Vulnerability

CVE-2025-8088

RARLAB WinRAR Path Traversal Vulnerability

CVE-2023-38831

RARLAB WinRAR Code Execution Vulnerability

CVE-2022-30333

RARLAB UnRAR Directory Traversal Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services