VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 03:28 UTC

CVE-2018-20250

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating …

Read full description

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.8: +1.17
Fresh EPSS: 96.00%: +0.48

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Help Net Security

Press · 21 Aug 2023, 07:00 · WinRAR vulnerable to remote code execution, patch now! (CVE-2023-40477) - Help Net Security

SOC Prime

Press · 19 Apr 2022, 07:00 · Cobalt Strike Beacon Malware Spread Via Targeted Phishing Emails Related to Azovstal: Cyber-Attack on Ukrainian Government Entities - SOC Prime

Help Net Security

Press · 06 Feb 2020, 08:00 · Which vulnerabilities were most exploited by cybercriminals in 2019? - Help Net Security

Qualys

Press · 27 Dec 2019, 08:00 · Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking - Qualys

McAfee

Press · 15 Nov 2019, 11:01 · Attackers Exploiting WinRAR UNACEV2.DLL Vulnerability (CVE-2018-20250) - McAfee

See all 10 source documents

Microsoft

Press · 10 Apr 2019, 07:00 · Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability - Microsoft

The Hacker News

Press · 28 Mar 2019, 07:00 · Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms - The Hacker News

BleepingComputer

Press · 15 Mar 2019, 07:00 · Over 100 Exploits Found for 19-Year Old WinRAR RCE Bug - BleepingComputer

The Hacker News

Press · 15 Mar 2019, 07:00 · Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates - The Hacker News

Check Point Research

Press · 20 Feb 2019, 08:00 · Extracting a 19 Year Old Code Execution from WinRAR - Check Point Research

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 1 repos with metrics

Repository	Stars	Forks	Language	Updated
nmweizi/CVE-2018-20250-poc-winrar	0	2	—	22 Feb 2019, 13:20

Public exploit evidence

exploitdb #46552 2019-02-22
exploitdb #46756 2019-04-25

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.8; EPSS 96.0%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, no prior privileges, user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:59.533677+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

05 Feb 2019, 20:00

First press mention

20 Feb 2019, 08:00

Added to the CISA KEV catalog

15 Feb 2022, 00:00

Latest press mention

21 Aug 2023, 07:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

2 repositories