Critical 7-Zip Flaw Allows Code Execution by Opening Crafted XZ

CVE-2025-11001 is a directory traversal vulnerability (CWE-22) in 7-Zip's handling of symbolic links inside ZIP archives, which an attacker can leverage for arbitrary code execution. Exploitation requires interaction with the product — typically a user opening or extracting a crafted ZIP (the CVSS vector is local with user interaction required), though real-world attack vectors vary by implementation — allowing the attacker to escape the intended extraction directory and run code with the privileges of the account doing the extraction, often a service account. Any 7-Zip installation that processes untrusted archives, from desktop users to server-side automation and pipelines, is potentially affected; the disclosure data does not specify a vulnerable version range. Security outlets report a public proof-of-concept and active exploitation in the wild, and the UK NHS has issued an advisory; the flaw carries a high EPSS score (27% probability of exploitation within 30 days, 98th percentile) but is not yet in CISA's KEV catalog.

Do: Update 7-Zip to the latest patched release available from the vendor (the exact fixed version number is not specified in this data). Until patched, avoid opening or auto-extracting ZIP archives from untrusted sources — especially archives containing symbolic links — and audit any server-side jobs, CI pipelines, or gateway services that invoke 7-Zip on external archives, since code executes with the service account's privileges; related coverage also flags code execution via crafted XZ archives, so treat those cautiously as well. Given reports of in-the-wild exploitation and the NHS advisory, prioritize patching shared and high-interaction systems.