PT-2025-32410 · Igor Pavlov+4 · 7-Zip+4

Lunbun · Published 2025-08-03 · Updated 2026-06-01 · CVE-2025-55188

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.01

Description An issue exists in 7-Zip where symbolic links are not always properly handled during the extraction of archives. This flaw allows a remote attacker to use a specially crafted archive to perform arbitrary file writes, which can lead to the overwriting of critical system files and potentially result in remote code execution. This issue specifically affects 7-Zip on Linux-based operating systems by bypassing security restrictions through the incorrect identification of symbolic links before file access.

Recommendations Update to version 25.01.

Exploit

Fix

DoS

RCE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2025-11829

BDU:2025-09673

CVE-2025-55188

Affected Products

7-Zip

Alt Linux

Astra Linux

Debian

Red Os

References · 61

• 🔥 https://github.com/hunters-sec/CVE-2025-55188-7z-exploit · Exploit
• 🔥 https://github.com/lunbun/CVE-2025-55188 · Exploit
• 🔥 https://lunbun.dev/blog/cve-2025-55188 · Exploit
• 🔥 https://youtu.be/sWT6M1cfnwM · Exploit
• https://cve.org/CVERecord?id=CVE-2025-55188 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55188 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-55188 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-55188 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09673 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-55188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55188 · Security Note