CVE-2025-11001

nvd.nist.gov • June 29, 2026

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

7-Zip Vulnerability CVE-2025-11001 Enables Remote Code Execution Attacks A critical vulnerability in 7-Zip, identified as CVE-2025-11001, allows remote code execution via symbolic link manipulation in ZIP files. This flaw, which affects versions of 7-Zip starting from 21.02, has been actively exploited, prompting warnings from cybersecurity organizations, including NHS England Digital. Attackers can exploit this vulnerability by crafting malicious ZIP files that lead to unintended directory traversal, enabling arbitrary code execution in the context of the service account running 7-Zip. The vulnerability carries a CVSS score of 7.0 and was reported by Ryota Shiga from GMO Flatt Security Inc. Users are urged to update to version 25.00 or later to mitigate risks. A proof-of-concept exploit is publicly available, increasing the urgency for users to apply patches. The vulnerability is limited to Windows platforms and requires elevated user privileges for exploitation. 2 sources 72

Extracted Entities

CVE-2025-11001

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)