PoC Exploit for 7-Zip Vulnerabilities that Allows Remote Code Execution

Recent security research has uncovered two critical vulnerabilities in the file archiver software 7-Zip. These vulnerabilities, identified as CVE-2025-11001 and CVE-2025-11002, have the potential to allow attackers to execute arbitrary code remotely via malicious ZIP files. These issues were disclosed by the Zero Day Initiative on October 7, 2025, and are linked to the improper handling of symbolic links during ZIP extraction on Windows systems.

The vulnerabilities affect 7-Zip versions 21.02 through 24.09, involving flaws in the symlink conversion process, which enables path traversal attacks. Discovered by Ryota Shiga of GMO Flatt Security Inc., the vulnerabilities exploit the manner in which 7-Zip processes Linux-style symlinks by converting them to Windows equivalents without proper validation measures.

An analysis by the security researcher known as pacbypass reveals that these vulnerabilities are located in the ArchiveExtractCallback.cpp module, particularly in functions such as IsSafePath and CLinkLevelsInfo::Parse.

The core issue is rooted in 7-Zip's extraction logic, which fails to properly validate symlink targets. Specifically, when a ZIP file contains a Linux symlink pointing to a Windows absolute path, the software misidentifies it as relative due to a flawed absolute path check intended for Linux or WSL environments. This bypasses safety checks in IsSafePath, allowing the symlink to resolve outside the extraction directory.

During symlink creation in SetFromLinkPath, 7-Zip appends the extraction folder path to the target, creating a seemingly safe relative path that circumvents validation. A subsequent check in CloseReparseAndFile overlooks directory-specific scrutiny for non-directories, permitting the symlink to point arbitrarily.

Patches introduced in version 25.00 include a new IsSafePath overload with an isWSL flag and improved parsing to correctly detect absolute paths, addressing these vulnerabilities.

Exploiting these vulnerabilities requires crafting a ZIP file where a symlink is extracted first, redirecting subsequent files to sensitive locations such as the Desktop or system directories. For example, a malicious archive could create a symlink named "link" pointing to C:\Users\[Username]\Desktop, followed by a payload like calc.exe. Upon extraction, 7-Zip follows the link, writing the executable to the target, potentially leading to code execution if the user runs it.

The proof-of-concept (PoC) is available on pacbypass's GitHub repository and demonstrates this by unpacking a directory structure that dereferences the symlink, enabling arbitrary file writes. However, exploitation requires elevated privileges, developer mode, or an elevated service context, restricting it to targeted attacks rather than widespread phishing attempts. The vulnerability affects Windows systems exclusively, with no impact on Linux or macOS.

Users are advised to update to 7-Zip version 25.00 immediately, as this update comprehensively addresses the identified vulnerabilities. Disabling symlink support during extraction or scanning archives with antivirus tools can further reduce exposure. These vulnerabilities underscore the ongoing risks in archive handlers, mirroring past 7-Zip flaws such as directory traversals.

With the public availability of the PoC, there is a potential for these vulnerabilities to be weaponized for initial access in phishing campaigns. Organizations relying on 7-Zip for bulk extractions should audit workflows and monitor for anomalous file writes.

Based on reporting by Cyber Security News.