7-Zip RCE flaw (CVE-2025-11001) actively exploited in attacks in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11001 | Directory Traversal RCE in 7-Zip ZIP Symbolic Link Handling CVE-2025-11001 is a directory traversal vulnerability (CWE-22) in 7-Zip's handling of symbolic links inside ZIP archives, which an attacker can leverage for arbitrary code execution. Exploitation requires interaction with the product — typically a user opening or extracting a crafted ZIP (the CVSS vector is local with user interaction required), though real-world attack vectors vary by implementation — allowing the attacker to escape the intended extraction directory and run code with the privileges of the account doing the extraction, often a service account. Any 7-Zip installation that processes untrusted archives, from desktop users to server-side automation and pipelines, is potentially affected; the disclosure data does not specify a vulnerable version range. Security outlets report a public proof-of-concept and active exploitation in the wild, and the UK NHS has issued an advisory; the flaw carries a high EPSS score (27% probability of exploitation within 30 days, 98th percentile) but is not yet in CISA's KEV catalog. Do: Update 7-Zip to the latest patched release available from the vendor (the exact fixed version number is not specified in this data). Until patched, avoid opening or auto-extracting ZIP archives from untrusted sources — especially archives containing symbolic links — and audit any server-side jobs, CI pipelines, or gateway services that invoke 7-Zip on external archives, since code executes with the service account's privileges; related coverage also flags code execution via crafted XZ archives, so treat those cautiously as well. Given reports of in-the-wild exploitation and the NHS advisory, prioritize patching shared and high-interaction systems. | 7.8 | 27% |
| masstens of millions of installations worldwide |
Full article308 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 19, 2025
A remote code execution vulnerability, tracked as CVE-2025-11001, in the 7-Zip software is under active exploitation.
A new 7-Zip flaw tracked as CVE-2025-11001 (CVSS score of 7.0) is now being actively exploited in the wild, NHS England warns. Remote attackers can trigger the vulnerability to execute arbitrary code on affected installations of 7-Zip.
“Active exploitation of CVE-2025-11001 has been observed in the wild.” reads the alert published by NHS. “A security researcher has also publicly released a proof-of-concept (PoC) exploit for CVE-2025-11001. The PoC allows attackers to abuse symbolic-link handling to write files outside of the intended extraction folder, which in some scenarios, can enable arbitrary code execution.”
Malicious ZIP symlinks let attackers escape target folders and run code with the service account’s permissions.
“This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.” reads the advisory. “The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account.”
The researchers Ryota Shiga (GMO Flatt Security Inc.) with takumi-san.ai reported the vulnerability.
Version 25.00, released in July 2025, addressed the vulnerability.
“This vulnerability can only be exploited from the context of an elevated user / service account or a machine with developer mode enabled.” wrote security researcher Dominik (aka pacbypass), who released a PoC. “This vulnerability can only be exploited on Windows”
7-Zip users are recommended to quickly upgrade their version due to the availability of proof-of-concept (PoC) exploits.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2025-11001)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/184850/security/7-zip-rce-flaw-cve-2025-11001-actively-exploited-in-attacks-in-the-wild.html