CVE-2025-11001: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11001?
CVE-2025-11001 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-11001?
To mitigate CVE-2025-11001, update your 7-Zip software to the latest version as soon as it is available.
Who is affected by CVE-2025-11001?
CVE-2025-11001 affects installations of 7-Zip, specifically versions prior to the security update.
What type of vulnerability is CVE-2025-11001?
CVE-2025-11001 is a remote code execution vulnerability that requires user interaction to exploit.
Are there any attack vectors for CVE-2025-11001?
Yes, the attack vectors for CVE-2025-11001 can vary depending on the specific implementation of 7-Zip.