CVE-2025-11001
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
Description
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.
INFO
Published Date :
Nov. 19, 2025, 10:16 p.m.
Last Modified :
Nov. 24, 2025, 3:07 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.0 | HIGH | 99f1926a-a320-47d8-bbb5-42feb611262e | ||||
| CVSS 3.0 | HIGH | [email protected] | ||||
| CVSS 3.0 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update 7-Zip to the latest version.
- Apply vendor patches immediately.
- Review file handling configurations.
Public PoC/Exploit Available at Github
CVE-2025-11001 has a 8 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-11001.
| URL | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-949/ | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-11001 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-11001
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2025-11001
Python
None
Python
CVE-2025-11001 (CVSS 7.0) – 7-Zip < 25.00 Directory Traversal → RCE via crafted ZIP with symlink. Allows arbitrary file write when extracted as Administrator. Fixed in 7-Zip 25.00 (July 2025).
Python
None
Python
Latest CVEs with their Proof of Concept exploits.
Python
TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
bugbounty cve exp exploit payload poc rce vulnerability
Shell
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)
Python HTML
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-11001 vulnerability anywhere in the article.
-
The Cyber Express
NCSC Warns Prompt Injection Could Become the Next Major AI Security Crisis
The UK’s National Cyber Security Centre (NCSC) has issued a fresh warning about the growing threat of prompt injection, a vulnerability that has quickly become one of the biggest security concerns in ... Read more
-
CybersecurityNews
Cybersecurity News Weekly Newsletter – Fortinet, Chrome 0-Day Flaws, Cloudflare Outage and Salesforce Gainsight Breach
Welcome to this week’s edition of the Cybersecurity News Weekly Newsletter, where we analyze the critical incidents defining the current threat landscape. If this week has taught us anything, it is th ... Read more
-
hackread.com
Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
A vulnerability has been found in the very popular, free file-compressing tool 7-Zip. The flaw, tracked as CVE-2025-11001, has a public exploit, leading to a high-risk warning from the UK’s NHS Englan ... Read more
-
Help Net Security
Week in review: Stealth-patched FortiWeb vulnerability under active exploitation, Logitech data breach
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The tech that turns supply chains from brittle to unbreakable In this Help Net Security interview, Sev ... Read more
-
The Cyber Express
CERT-In Warns of Critical Asus Router Flaw Exposing Millions in India
According to the Indian Computer Emergency Response Team (CERT-In), thousands of households, small offices, and service providers across the country may already be at risk due to a newly uncovered aut ... Read more
-
The Cyber Express
Stolen VPN Credentials Most Common Ransomware Attack Vector
Compromised VPN credentials are the most common initial access vector for ransomware attacks, according to a new report. Nearly half of ransomware attacks in the third quarter abused compromised VPN c ... Read more
-
The Cyber Express
Critical 7-Zip Vulnerability CVE-2025-11001 Prompts NHS Cyber Alert
A newly discovered security flaw, identified as CVE-2025-11001, is targeting users across both public and private sectors. The vulnerability, affecting all versions of 7-Zip before 25.00, allows attac ... Read more
-
security.nl
Britse gezondheidszorg NHS waarschuwt voor misbruik van lek in 7-Zip
De Britse gezondheidszorg NHS waarschuwt voor actief misbruik van een kwetsbaarheid in het populaire archiveringsprogramma 7-Zip, waardoor remote code execution via speciaal geprepareerde zip-bestande ... Read more
-
Help Net Security
When IT fails, OT pays the price
State groups, criminal crews, and hybrid operators are all using familiar IT entry points to reach systems that support industrial processes, according to the latest Operational Technology Threat Repo ... Read more
The following table lists the changes that have been made to the
CVE-2025-11001 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 24, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CPE Configuration AND OR *cpe:2.3:a:7-zip:7-zip:24.09:*:*:*:*:*:*:* OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:* Added Reference Type Zero Day Initiative: https://www.zerodayinitiative.com/advisories/ZDI-25-949/ Types: Third Party Advisory -
New CVE Received by [email protected]
Nov. 19, 2025
Action Type Old Value New Value Added Description 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753. Added CVSS V3 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-22 Added Reference https://www.zerodayinitiative.com/advisories/ZDI-25-949/