Public PoC exploit for 7-Zip vulnerability is available (CVE-2025-11001)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11001 | Directory Traversal RCE in 7-Zip ZIP Symbolic Link Handling CVE-2025-11001 is a directory traversal vulnerability (CWE-22) in 7-Zip's handling of symbolic links inside ZIP archives, which an attacker can leverage for arbitrary code execution. Exploitation requires interaction with the product — typically a user opening or extracting a crafted ZIP (the CVSS vector is local with user interaction required), though real-world attack vectors vary by implementation — allowing the attacker to escape the intended extraction directory and run code with the privileges of the account doing the extraction, often a service account. Any 7-Zip installation that processes untrusted archives, from desktop users to server-side automation and pipelines, is potentially affected; the disclosure data does not specify a vulnerable version range. Security outlets report a public proof-of-concept and active exploitation in the wild, and the UK NHS has issued an advisory; the flaw carries a high EPSS score (27% probability of exploitation within 30 days, 98th percentile) but is not yet in CISA's KEV catalog. Do: Update 7-Zip to the latest patched release available from the vendor (the exact fixed version number is not specified in this data). Until patched, avoid opening or auto-extracting ZIP archives from untrusted sources — especially archives containing symbolic links — and audit any server-side jobs, CI pipelines, or gateway services that invoke 7-Zip on external archives, since code executes with the service account's privileges; related coverage also flags code execution via crafted XZ archives, so treat those cautiously as well. Given reports of in-the-wild exploitation and the NHS advisory, prioritize patching shared and high-interaction systems. | 7.8 | 27% |
| masstens of millions of installations worldwide | ||
| CVE-2025-11002 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2025-55188 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction. 7-Zip before 25.01 does not always properly handle symbolic links during extraction. NVD description · AI analysis pending | 3.6 | <1% | PoC ×3 |
| — |
Full article474 words · extracted from helpnetsecurity.com · click to collapse
NHS England Digital, the technology arm of the publicly-funded health service for England, has issued a warning about a 7-Zip vulnerability (CVE-2025-11001) being exploited by attackers.
“Active exploitation of CVE-2025-11001 has been observed in the wild,” the alert says, though it does not say who detected the attacks or whether they might be targeted or widespread.
CVE-2025-11001 and CVE-2025-11002
Introduced in 7-Zip v21.02, CVE-2025-11001 and CVE-2025-11002 are two path/directory traversal flaws that have been fixed in 7-Zip v25.00, released in July 2025.
The vulnerabilities were publicly revealed via Zero Day Initiative advisories on October 7, 2025, and credited to Ryota Shiga of GMO Flatt Security, who discovered them by using the company’s AI-powered application security auditor (Takumi).
“The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account,” both advisories note.
Another security researcher who goes by “PacBypass” analyzed the code differences between 7-Zip v24.09 and v25.00 and, ten days later, published a technical write-up about CVE-2025-11001 and a proof-of-concept exploit for it.
CVE-2025-11001 is only exploitable on Windows and only from the context of an elevated user/service account or a Windows machine with Developer Mode enabled, PacBypass noted.
“This is because it the 7-Zip process creates a symlink, which is a privileged operation on Windows. Hence the exploitation only makes sense when 7-Zip is used by a service account,” he explained.
Pre-empt attackers by updating 7-Zip
In August 2025, a third researcher revealed an arbitrary file write vulnerability (CVE-2025-55188) caused by 7-Zip’s improper handling of symbolic links, which may lead to code execution when the user extracts a maliciously crafted archive with 7-Zip.
CVE-2025-55188 was fixed in 7-Zip v25.01. “The code for handling symbolic links has been changed to provide greater security when extracting files from archives,” 7-Zip creator and maintainer Igor Pavlov noted at the time.
7-Zip users have been urged to upgrade to the latest available version as soon as possible, since the software does not have an auto-update feature.
Help Net Security has reached out to NHS England Digital for additional information about the attacks, and we’ll update this article when we hear back from them.
UPDATE (November 21, 2025, 07:40 a.m. ET):
NHS England Digital has updated the initial alert to say that “NHS England National [Cyber Security Operations Centre] has not observed exploitation of CVE-2025-11001 in the wild, and have removed references to exploitation that were included in error. The National CSOC is aware of a public proof-of-concept exploit.”
The original title of this article has been changed to reflect that.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/11/19/7-zip-vulnerability-is-being-actively-exploited-nhs-england-warns-cve-2025-11001/