CVE-2025-11001

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.01 7-Zip versions 21.02 through 25.00

Description 7-Zip contains a flaw in how it handles symbolic links within ZIP files. This issue allows attackers to perform directory traversal, potentially writing files to unintended locations and executing arbitrary code on affected systems. The vulnerability is actively being exploited in the wild, with reports of attacks leveraging crafted ZIP files. The flaw exists due to improper handling of symbolic links during file extraction. An attacker can create a malicious ZIP archive containing a symbolic link that, when extracted, redirects file writing to a location outside the intended directory. This can lead to the execution of code in the context of a service account. Multiple sources confirm active exploitation of this vulnerability, including reports from NHS England.

Recommendations Update 7-Zip to version 25.00 or later. Update 7-Zip to version 25.01 or later.