7-Zip Vulnerabilities Allowing Remote Code Execution
Two critical vulnerabilities have been identified in 7-Zip’s processing of ZIP archives, allowing remote attackers to execute arbitrary code through directory traversal flaws.
Two critical vulnerabilities have been identified in 7-Zip’s processing of ZIP archives, allowing remote attackers to execute arbitrary code through directory traversal flaws.
The vulnerabilities occur due to improper handling of symbolic links within ZIP files, enabling crafted archives to access unintended locations and execute code under vulnerable service contexts.
Directory Traversal Leads to Code Execution
Security researchers have disclosed two related vulnerabilities, identified as CVE-2025-11002 and CVE-2025-11001. These issues involve an attacker supplying a malicious ZIP file with symbolic link entries, bypassing the installer’s directory boundaries.
CVE ID CVSS Score Affected Vendors Affected Products
CVE-2025-11002 7.0, AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H 7-Zip 7-Zip
CVE-2025-11001 7.0, AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H 7-Zip 7-Zip
Security researchers have disclosed two related vulnerabilities, identified as CVE-2025-11002 and CVE-2025-11001.
When 7-Zip processes such archives, it may follow links into directories outside the intended extraction path. This can lead to the overwriting of arbitrary files or the placement of malicious payloads in sensitive locations, which may then be executed by interacting services or scheduled tasks.
Exploitation requires minimal user interaction, such as opening or extracting the archive in a compromised environment.
Proof-of-Concept and Exploit Scenarios
A proof-of-concept demonstrates the creation of a ZIP archive with a symbolic link entry, such as ../../../../windows/system32/malicious.dll , pointing to an attacker-controlled file. Upon extraction by a service running under the SYSTEM account, the DLL is placed in the System32 directory.
A subsequent request to load that library, such as via a plugin or scheduled task, results in arbitrary code execution with elevated privileges.
Security teams should audit systems that automatically process ZIP files, especially in enterprise file-sharing and automated backup solutions. Implementing strict directory sanitization or disabling automatic extraction in untrusted contexts can mitigate exploitation prior to patch deployment.
7-Zip version 25.00 addresses these vulnerabilities by enforcing safe path canonicalization and blocking symbolic links that escape the intended extraction directory. Administrators are advised to upgrade immediately. The vulnerabilities were reported to the vendor on Thu, May 2, 2025, with a coordinated public advisory released and updated on Tue, Oct 7, 2025.
Indicators of compromise (IoCs) include unexpected presence of DLLs or executables in protected directories following archive extraction and suspicious ZIP entries containing excessive path traversal sequences. Organizations relying on automated ZIP extraction should review logs for anomalous directory traversal patterns and deploy the patched 7-Zip 25.00 promptly to prevent potential compromise.
Continuous monitoring of file-handling services and enforcing strict input validation remain essential defenses against similar ZIP-based attacks.
Based on reporting by GBHackers.