CVE-2018-20250

What it actually does

Path traversal in UNACEV2.dll allows crafted ACE archive filename fields to bypass the extraction destination directory and write files to arbitrary absolute paths on the filesystem.

Why it matters to the business

Attackers can silently drop executables into startup folders or system directories, enabling ransomware deployment and persistent compromise across many organizations that still use older WinRAR versions.

How an attack unfolds

An attacker creates a malicious ACE archive containing a filename field with absolute path patterns; the victim opens and extracts the archive with WinRAR; the extraction routine in UNACEV2.dll ignores the user-specified destination and writes attacker-controlled files directly to locations such as startup folders or system directories; execution occurs on next logon or service start. The vulnerability has been exploited in the wild by ransomware campaigns.

How to fix it

Upgrade WinRAR to version 5.70 or later on all endpoints; remove older versions including 5.61 and below; consider replacing WinRAR with a maintained alternative if continued ACE support is unnecessary.

How to confirm the fix worked

Verify installed WinRAR version is 5.70 or newer; scan for presence of unexpected files in common autostart locations; confirm UNACEV2.dll is no longer present or is from a patched package.

Typical attack path

1. Craft ACE archive with manipulated filename field containing absolute or traversal path
2. Distribute archive via email, web download, or shared storage
3. Victim opens archive and initiates extraction in WinRAR
4. Files written to attacker-chosen absolute paths outside intended folder
5. Malicious payload executes via startup, scheduled task, or service

How to detect it

Review extraction logs and file creation events around WinRAR or UNACEV2.dll activity; search for files written to absolute paths outside the extraction directory; examine startup folders, AppData, and system directories for unexpected executables timestamped near archive operations.

• UNACEV2.dll
• WinRAR Absolute Path Traversal
• ACE archive extraction to absolute path
• Unexpected executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
• File writes bypassing user-specified extraction folder

What your security team should do

• Immediately inventory all WinRAR installations and prioritize upgrade before any other action due to active ransomware exploitation and CISA KEV listing
• Block or monitor outbound traffic and file writes from UNACEV2.dll processes
• Deploy application allow-listing to prevent execution of dropped binaries from archive extractions
• Hunt for historical indicators of compromise in file system and startup locations