CVE-2025-11001

Published Nov 19, 2025

Last updated 11 days ago

7-Zip

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-11001 is a vulnerability that exists within the handling of symbolic links in ZIP files by 7-Zip. Crafted data in a ZIP file can cause the application to traverse to unintended directories. This vulnerability could allow remote attackers to execute arbitrary code on affected installations of 7-Zip. To exploit this, an attacker needs to supply a malicious ZIP file containing symbolic link entries that bypass the installer's intended directory boundaries. User interaction is required to exploit this vulnerability, such as opening or extracting a malicious ZIP file. An attacker can leverage this vulnerability to execute code in the context of a service account. This issue has been fixed in 7-Zip 25.00.

Description: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.
Source: zdi-disclosures@trendmicro.com
NVD status: Analyzed
Products: 7-zip

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 3.0

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

zdi-disclosures@trendmicro.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:7-zip:7-zip:24.09:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0CE235C-0238-4BFD-A447-9B83469F6598"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*",
            "vulnerable": false,
            "matchCriteriaId": "82132539-3C34-4B63-BE2A-F51077D8BC5A"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.