CVE-2025-11002

Published Jan 23, 2026

Last updated 4 days ago

7-Zip

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-11002 is a vulnerability that exists within the handling of symbolic links in ZIP files by 7-Zip. By crafting malicious data within a ZIP file, an attacker can cause the application to traverse to unintended directories. This vulnerability could allow remote attackers to execute arbitrary code on affected installations of 7-Zip. The vulnerability stems from the improper processing of symbolic links within ZIP archives, potentially allowing a malicious ZIP file to force traversal outside the intended extraction directory. Exploitation requires user interaction, such as opening or extracting a malicious ZIP file. 7-Zip version 25.00 addresses the vulnerability.

Description: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.
Source: zdi-disclosures@trendmicro.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.0

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

zdi-disclosures@trendmicro.com: CWE-22

Hype score: Not currently trending

References